CVE-2012-4751 Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary we...
MediumCVSS 4.3
EPSS 5.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/otrs2(Debian:11) | < 3.1.7+dfsg1-6 | 3.1.7+dfsg1-6 |
| debian/otrs2(Debian:11) | = 2.0.4p01-10 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-11 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-12 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-13 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-14 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-14.1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-15 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-16 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-17 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-18 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-6 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-7 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-8 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.4p01-9 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.99beta1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.0.99beta1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.4-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.4-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.5-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.5-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.5-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.6-1 | No fix listed |
Show 133 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/otrs2(Debian:11) | = 2.1.7-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.1.7-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.0~beta2-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.0~beta3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.2-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.4-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.5-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.5-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.6-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2lenny1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2lenny2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-2lenny3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.2.7-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.2-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.2-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.3-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-6 | No fix listed |
| debian/otrs2(Debian:11) | = 2.3.4-7 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.10+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.10+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.10+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.5-5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.6-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.6-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.7-6 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.8+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze1 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze3 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-3+squeeze5 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-4 | No fix listed |
| debian/otrs2(Debian:11) | = 2.4.9+dfsg1-5 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.10+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.10+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.11+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.8+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.0.9+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.0~beta4+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.0~beta5+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.0~rc1+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.1+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.1+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.2+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.2+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.2+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.3+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.3+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.4+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.5+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.5+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.5+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.6+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-1 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-2 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-3 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-4 | No fix listed |
| debian/otrs2(Debian:11) | = 3.1.7+dfsg1-5 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta1 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta2 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta3 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta4 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta5 | No fix listed |
| OTRS AG OTRS | = 2.4.0-beta6 | No fix listed |
| OTRS AG OTRS | = 2.4.1 | No fix listed |
| OTRS AG OTRS | = 2.4.2 | No fix listed |
| OTRS AG OTRS | = 2.4.3 | No fix listed |
| OTRS AG OTRS | = 2.4.4 | No fix listed |
| OTRS AG OTRS | = 2.4.5 | No fix listed |
| OTRS AG OTRS | = 2.4.6 | No fix listed |
| OTRS AG OTRS | = 2.4.7 | No fix listed |
| OTRS AG OTRS | = 2.4.8 | No fix listed |
| OTRS AG OTRS | = 2.4.9 | No fix listed |
| OTRS AG OTRS | = 2.4.10 | No fix listed |
| OTRS AG OTRS | = 2.4.11 | No fix listed |
| OTRS AG OTRS | = 2.4.12 | No fix listed |
| OTRS AG OTRS | = 2.4.13 | No fix listed |
| OTRS AG OTRS | = 2.4.14 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta1 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta2 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta3 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta4 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta5 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta6 | No fix listed |
| OTRS AG OTRS | = 3.0.0-beta7 | No fix listed |
| OTRS AG OTRS | = 3.0.1 | No fix listed |
| OTRS AG OTRS | = 3.0.2 | No fix listed |
| OTRS AG OTRS | = 3.0.3 | No fix listed |
| OTRS AG OTRS | = 3.0.4 | No fix listed |
| OTRS AG OTRS | = 3.0.5 | No fix listed |
| OTRS AG OTRS | = 3.0.6 | No fix listed |
| OTRS AG OTRS | = 3.0.7 | No fix listed |
| OTRS AG OTRS | = 3.0.8 | No fix listed |
| OTRS AG OTRS | = 3.0.9 | No fix listed |
| OTRS AG OTRS | = 3.0.10 | No fix listed |
| OTRS AG OTRS | = 3.0.11 | No fix listed |
| OTRS AG OTRS | = 3.0.12 | No fix listed |
| OTRS AG OTRS | = 3.0.13 | No fix listed |
| OTRS AG OTRS | = 3.0.14 | No fix listed |
| OTRS AG OTRS | = 3.0.15 | No fix listed |
| OTRS AG OTRS | = 3.0.16 | No fix listed |
| OTRS AG OTRS | = 3.1.0 | No fix listed |
| OTRS AG OTRS | = 3.1.1 | No fix listed |
| OTRS AG OTRS | = 3.1.2 | No fix listed |
| OTRS AG OTRS | = 3.1.3 | No fix listed |
| OTRS AG OTRS | = 3.1.4 | No fix listed |
| OTRS AG OTRS | = 3.1.5 | No fix listed |
| OTRS AG OTRS | = 3.1.6 | No fix listed |
| OTRS AG OTRS | = 3.1.7 | No fix listed |
| OTRS AG OTRS | = 3.1.8 | No fix listed |
| OTRS AG OTRS | = 3.1.9 | No fix listed |
| OTRS AG OTRS | = 3.1.10 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- openSUSE-SU-2013:0145 vendor-advisory
- packetstormsecurity.org
- VU#603276 third-party-advisory us-government-resource
- www.otrs.com vendor-advisory
- 56093 vdb-entry
- znuny.com exploit
- znuny.com