CVE-2012-2582 Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3...
MediumCVSS 4.3
EPSS 4.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/otrs2(Debian:11) | < 3.1.7+dfsg1-4 | 3.1.7+dfsg1-4 |
| debian/otrs2(Debian:11) | = 2.0.4p01-10 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-11 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-12 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-13 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-14 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-14.1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-15 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-16 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-17 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-18 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-6 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-7 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-8 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-9 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.99beta1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.99beta1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.4-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.4-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.5-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.5-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.5-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.6-1 | No fix listed |
Show 142 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/otrs2(Debian:11) | = 2.1.7-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.7-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.0~beta2-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.0~beta3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.2-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.4-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.5-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.5-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.6-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2lenny1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2lenny2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2lenny3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.2-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.2-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-6 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-7 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.10+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.10+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.10+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.6-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.6-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-6 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.8+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-5 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.10+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.10+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.11+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.8+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.9+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.0~beta4+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.0~beta5+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.0~rc1+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.1+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.1+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.2+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.2+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.2+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.3+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.3+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.4+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.5+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.5+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.5+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.6+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-3 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta1 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta2 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta3 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta4 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta5 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta6 | No fix listed |
| OTRS AG OTRS | = 2.4.1 | No fix listed |
| OTRS AG OTRS | = 2.4.2 | No fix listed |
| OTRS AG OTRS | = 2.4.3 | No fix listed |
| OTRS AG OTRS | = 2.4.4 | No fix listed |
| OTRS AG OTRS | = 2.4.5 | No fix listed |
| OTRS AG OTRS | = 2.4.6 | No fix listed |
| OTRS AG OTRS | = 2.4.7 | No fix listed |
| OTRS AG OTRS | = 2.4.8 | No fix listed |
| OTRS AG OTRS | = 2.4.9 | No fix listed |
| OTRS AG OTRS | = 2.4.10 | No fix listed |
| OTRS AG OTRS | = 2.4.11 | No fix listed |
| OTRS AG OTRS | = 2.4.12 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta1 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta2 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta3 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta4 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta5 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta6 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta7 | No fix listed |
| OTRS AG OTRS | = 3.0.1 | No fix listed |
| OTRS AG OTRS | = 3.0.2 | No fix listed |
| OTRS AG OTRS | = 3.0.3 | No fix listed |
| OTRS AG OTRS | = 3.0.4 | No fix listed |
| OTRS AG OTRS | = 3.0.5 | No fix listed |
| OTRS AG OTRS | = 3.0.6 | No fix listed |
| OTRS AG OTRS | = 3.0.7 | No fix listed |
| OTRS AG OTRS | = 3.0.8 | No fix listed |
| OTRS AG OTRS | = 3.0.9 | No fix listed |
| OTRS AG OTRS | = 3.0.10 | No fix listed |
| OTRS AG OTRS | = 3.0.11 | No fix listed |
| OTRS AG OTRS | = 3.0.12 | No fix listed |
| OTRS AG OTRS | = 3.0.13 | No fix listed |
| OTRS AG OTRS | = 3.0.14 | No fix listed |
| OTRS AG OTRS | = 3.1.0 | No fix listed |
| OTRS AG OTRS | = 3.1.1 | No fix listed |
| OTRS AG OTRS | = 3.1.2 | No fix listed |
| OTRS AG OTRS | = 3.1.3 | No fix listed |
| OTRS AG OTRS | = 3.1.4 | No fix listed |
| OTRS AG OTRS | = 3.1.5 | No fix listed |
| OTRS AG OTRS | = 3.1.6 | No fix listed |
| OTRS AG OTRS | = 3.1.7 | No fix listed |
| OTRS AG OTRS | = 3.1.8 | No fix listed |
| OTRS AG otrs itsm | = 2.1.0 | No fix listed |
| OTRS AG otrs itsm | = 2.1.1 | No fix listed |
| OTRS AG otrs itsm | = 2.1.2 | No fix listed |
| OTRS AG otrs itsm | = 2.1.3 | No fix listed |
| OTRS AG otrs itsm | = 2.1.4 | No fix listed |
| OTRS AG otrs itsm | = 3.0.0 | No fix listed |
| OTRS AG otrs itsm | = 3.0.1 | No fix listed |
| OTRS AG otrs itsm | = 3.0.2 | No fix listed |
| OTRS AG otrs itsm | = 3.0.3 | No fix listed |
| OTRS AG otrs itsm | = 3.0.4 | No fix listed |
| OTRS AG otrs itsm | = 3.0.5 | No fix listed |
| OTRS AG otrs itsm | = 3.1.0 | No fix listed |
| OTRS AG otrs itsm | = 3.1.1 | No fix listed |
| OTRS AG otrs itsm | = 3.1.2 | No fix listed |
| OTRS AG otrs itsm | = 3.1.3 | No fix listed |
| OTRS AG otrs itsm | = 3.1.4 | No fix listed |
| OTRS AG otrs itsm | = 3.1.5 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- openSUSE-SU-2012:1105 vendor-advisory
- 50513 third-party-advisory
- DSA-2536 vendor-advisory
- VU#582879 exploit third-party-advisory us-government-resource
- www.otrs.com vendor-advisory