CVE-2012-4751

Description

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.

References

http://znuny.com/en/#%21/advisory/ZSA-2012-03

http://www.securityfocus.com/bid/56093

http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/

http://www.kb.cert.org/vuls/id/603276

http://packetstormsecurity.org/files/117504/OTRS-3.1-Cross-Site-Scripting.html

http://lists.opensuse.org/opensuse-updates/2013-01/msg00036.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3