Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

This updated fixes a cross site scripting (XSS) issue in otrs.
(CVE-2011-1518)

Upstream advisory: http://otrs.org/advisory/OSA-2011-01-en/

Multiple cross-site scripting vulnerabilities were discovered in Open Ticket Request System (OTRS), a trouble-ticket system. (CVE-2011-1518 )

In addition, this security update fix a failure when upgrading the package from lenny to squeeze.

The oldstable distribution (lenny) is not affected by this problem.

OTRS Security Advisory reports :

- Several XSS attacks possible : An attacker could trick a logged in user to following a prepared URL inside of the OTRS system which causes a page to be shown that possibly includes malicious !JavaScript code because of incorrect escaping during the generation of the HTML page.

ID	Name	Product	Family	Severity
75989	openSUSE Security Update : otrs (openSUSE-SU-2011:0464-1)	Nessus	SuSE Local Security Checks	medium
75702	openSUSE Security Update : otrs (openSUSE-SU-2011:0464-1)	Nessus	SuSE Local Security Checks	medium
53832	Debian DSA-2231-1 : otrs2 - XSS	Nessus	Debian Local Security Checks	medium
53397	FreeBSD : OTRS -- Several XSS attacks possible (a4372a68-652c-11e0-a25a-00151735203a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-1518

medium

Tenable Plugins

medium

medium

medium

medium