Vulnerability · Published Jul 24, 2023 · Assigned by OTRS
CVE-2023-38057XSS stored in survey answers
Medium 4.1
In plain English
A medium-severity improper input validation in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2023-38057 |
| Ubuntu:24.04:LTS | znuny | no fix listed | UBUNTU-CVE-2023-38057 |
| Ubuntu:25.10 | znuny | no fix listed | UBUNTU-CVE-2023-38057 |
| Ubuntu:26.04:LTS | znuny | no fix listed | UBUNTU-CVE-2023-38057 |
| Ubuntu:26.10 | znuny | no fix listed | UBUNTU-CVE-2023-38057 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | OTRS | 7.0.x – before 7.0.328.0.x – before 8.0.13 |
| OTRS AG | ((OTRS)) Community Edition | 6.0.x – through 6.0.22 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N