CVE-2012-2582
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OTRS Open Technology Real Services 3.1.4 - Persistent Cross-Site Scripting2012-08-08 · webapps · windows · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Otrs | Otrs | Versions 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5 |
| Otrs | Otrs Itsm | Versions 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00024.html
- http://secunia.com/advisories/50513
- http://www.debian.org/security/2012/dsa-2536
- http://www.kb.cert.org/vuls/id/582879
- http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01/
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00024.html
- http://secunia.com/advisories/50513
- http://www.debian.org/security/2012/dsa-2536
- http://www.kb.cert.org/vuls/id/582879
- http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01/