Release Note

OTRS Security Advisory 2023-09

Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Please send information regarding vulnerabilities in OTRS to: security@otrs.org

PGP Key

pub 2048R/9C227C6B 2011-03-21
uid OTRS Security Team <security@otrs.org>
GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 7C6B

Security Advisory Details

ID: OSA-2023-09
Date: 2023-10-16
Title: Possible XSS execution in customer information
Severity: 3.5 LOW
Product: OTRS 7.0.x, OTRS 8.0.x
Fixed in: OTRS 7.0.47, OTRS 8.0.37
FULL CVSS v3.1 VECTOR: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
References: CVE-2023-5421

OSA-2023-09 Possible XSS executed in customer information (CVE-2023-5421)

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved. The issue only occurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.

PRODUCT AFFECTED:

This issue affects

OTRS: from 7.0.X before 7.0.47,
OTRS: from 8.0.X before 8.0.37
((OTRS)) Community Edition: from 6.0.X through 6.0.34.

PROBLEM:

CWE-20 Improper Input Validation CWE-20

Impact:

CAPEC-63 Cross-Site Scripting (XSS) CAPEC-63

Product Status

Product

Affected

OTRS AG OTRS » Agent interface

Default status is affected

from 7.0.x before 7.0.47

from 8.0.x before 8.0.37

OTRS AG ((OTRS)) Community Edition » Agent Interface

Default status is affected

from 6.0.x through 6.0.34

SOLUTION:

Update to OTRS 7.0.47 or OTRS 8.0.37.

Workaround:

Switch AdminCustomerUser::UseAutoComplete off

MODIFICATION HISTORY:

CVSS SCORE:

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

RISK LEVEL:

LOW

ACKNOWLEDGEMENTS:

Special thanks to Tim Püttmanns for reporting these vulnerability.