CVE-2020-1771
published 2020-03-27CVE-2020-1771: Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.83%
53.1th percentile
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | otrs2 | < otrs2 6.0.27-1 (bullseye) | otrs2 6.0.27-1 (bullseye) |
| otrs | otrs | 5.0.0 – 5.0.41 | — |
| otrs | otrs | 6.0.0 – 6.0.26 | — |
| otrs | otrs | 7.0.0 – 7.0.15 | — |
| otrs_ag | community_edition | 6.0.x – 6.0.26 | — |
| otrs_ag | otrs | 7.0.x – 7.0.15 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
vendor_debian4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2020-1771: otrs2 - Attacker is able craft an article with a link to the customer address book with ...
vendor_debian·2020·CVSS 4.6
CVE-2020-1771 [MEDIUM] CVE-2020-1771: otrs2 - Attacker is able craft an article with a link to the customer address book with ...
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Scope: local
bullseye: resolved (fixed in 6.0.27-1)
GHSA
GHSA-38fp-9j49-g4gm: Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript)
ghsa_unreviewed·2022-05-24
CVE-2020-1771 [LOW] CWE-79 GHSA-38fp-9j49-g4gm: Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript)
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
OSV
CVE-2020-1771: Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript)
osv·2020-03-27·CVSS 5.4
CVE-2020-1771 [MEDIUM] CVE-2020-1771: Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript)
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlhttps://otrs.com/release-notes/otrs-security-advisory-2020-08/http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlhttps://otrs.com/release-notes/otrs-security-advisory-2020-08/
2020-03-27
Published