Vulnerability · Published Sep 6, 2021 · Assigned by OTRS
CVE-2021-36094XSS attack in appointment edit popup screen
Medium 5.7
In plain English
A medium-severity cross-site scripting in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2021-36094 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | ((OTRS)) Community Edition | 6.0.1 – before 6.0.x* |
| OTRS AG | OTRS | 7.0.x – through 7.0.28 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
References
- https://otrs.com/release-notes/otrs-security-advisory-2021-17/ x_refsource_CONFIRM