CVE-2020-1766 — Cross-site Scripting in Otrs
Severity
6.1MEDIUMNVD
CNA2.0
EPSS
0.8%
top 26.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 10
Latest updateMay 24
Description
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages3 packages
▶CVEListV5otrs_ag/community_edition5.0.x version 5.0.39 and prior versions, 6.0.x version 6.0.24 and prior versions+1
Also affects: Debian Linux 8.0
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-m842-x755-qmxc: Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javas↗2022-05-24
OSV▶
CVE-2020-1766: Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javas↗2020-01-10