| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 3.7 | $0-$5k | 0.00 |
Summary
A vulnerability categorized as problematic has been discovered in OTRS. Impacted is the function AdminCustomerUser::UseAutoComplete. Executing a manipulation of the argument CustomerID can lead to cross site scripting.
This vulnerability is handled as CVE-2023-5421. The attack can only be done within the local network. There is not any exploit available.
It is advisable to upgrade the affected component.
Details
A vulnerability classified as problematic was found in OTRS (Service Management Software) (affected version unknown). This vulnerability affects the function AdminCustomerUser::UseAutoComplete. The manipulation of the argument CustomerID with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:
An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
The weakness was released 10/16/2023. The advisory is shared for download at otrs.com. This vulnerability was named CVE-2023-5421 since 10/05/2023. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.
Upgrading eliminates this vulnerability. The upgrade is hosted for download at otrs.com.
Once again VulDB remains the best source for vulnerability data.
Product
Type
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 3.7VulDB Meta Temp Score: 3.7
VulDB Base Score: 2.1
VulDB Temp Score: 2.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.5
NVD Vector: 🔍
CNA Base Score: 3.5
CNA Vector (OTRS AG): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Cross site scriptingCWE: CWE-79 / CWE-94 / CWE-74
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: otrs.com
Timeline
10/05/2023 🔍10/16/2023 🔍
10/16/2023 🔍
11/02/2023 🔍
Sources
Advisory: otrs.comStatus: Confirmed
CVE: CVE-2023-5421 (🔍)
GCVE (CVE): GCVE-0-2023-5421
GCVE (VulDB): GCVE-100-242236
Entry
Created: 10/16/2023 12:27Updated: 11/02/2023 20:12
Changes: 10/16/2023 12:27 (50), 11/02/2023 20:12 (11)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.