Log in Start free

Vulnerability · Published Jan 10, 2020 · Assigned by OTRS

CVE-2020-1766Improper handling of uploaded inline images

Low 2.0

In plain English

A low-severity cross-site scripting in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)2.0Low
Exploit odds (30 days)1.2%top 30.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.

Affected products (as reported)

VendorProductVersions
OTRS AG ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions6.0.x version 6.0.24 and prior versions
OTRS AG OTRS 7.0.x version 7.0.13 and prior versions

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

References