UBUNTU-CVE-2017-9299
Dashboard / Vulnerabilities / UBUNTU-CVE-2017-9299
Summary:
Details: Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS] and Direction=[XSS] attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20 release, for example, is not affected.
References: https://ubuntu.com/security/CVE-2017-9299, http://code610.blogspot.com/2017/05/turnkey-feat-otrs.html, https://www.cve.org/CVERecord?id=CVE-2017-9299
Affected packages
Package
Name: otrs2
Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -5.0.7-1
Affected versions
4.0.10-1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
