Vulnerability · Published Feb 7, 2022 · Assigned by OTRS

CVE-2022-0473Dynamic field error message is vulnerable to XSS

Low 3.8

In plain English

A low-severity cross-site scripting in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.

Affected products (as reported)

Vendor	Product	Versions
OTRS AG	OTRS	7.0.x – through 7.0.31

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://otrs.com/release-notes/otrs-security-advisory-2022-01/ x_refsource_CONFIRM