Unscored CVE-2018-19141 EUVD-2018-10853GHSA-5j7r-jxpc-qhpw

Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL b…

Published Nov 11, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: otrs2 Package: otrs2 Ecosystem: Debian Ecosystem: Ubuntu

Description

Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 11	otrs2	6.0.1-1	—
Debian 8	otrs2	3.3.18-1+deb8u7	DLA-1592-1

Ubuntu