NetSight
IP …
medium6.1Public exploit code

CVE-2013-2637

A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.

Affected products

VendorProductAffected versions
OtrsFaq
before 2.0.8
from 2.1.0 before 2.1.4
OtrsOtrs Itsm
before 3.0.7
from 3.1.0 before 3.1.8
from 3.2.0 before 3.2.4
OpensuseOpensuse
Versions 12.2, 12.3

Weakness classification

CWE-79

References