CVE-2022-39050
published 2022-09-05CVE-2022-39050: An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when…
PriorityP420medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.45%
36.0th percentile
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| otrs | otrs | 6.0.0 – 6.0.32 | — |
| otrs | otrs | >= 7.0.0 < 7.0.37 | 7.0.37 |
| otrs | otrs | >= 8.0.0 < 8.0.25 | 8.0.25 |
| otrs_ag | community_edition | >= 6.0.1 < 6.0.x* | 6.0.x* |
| otrs_ag | otrs | 7.0.x – 7.0.36 | — |
| otrs_ag | otrs | 8.0.x – 8.0.24 | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
osv4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x46q-hjvj-45vc: An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent whe
ghsa_unreviewed·2022-09-06
CVE-2022-39050 [MEDIUM] CWE-79 GHSA-x46q-hjvj-45vc: An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent whe
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap
OSV
CVE-2022-39050: An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent whe
osv·2022-09-05·CVSS 4.8
CVE-2022-39050 [MEDIUM] CVE-2022-39050: An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent whe
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-05
Published