CVE-2013-2637 Cross-site scripting in n/a
Remote attackers can execute arbitrary code via XSS in OTRS ITSM and FAQ modules through changes, workorders, or articles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-2637?
CVE-2013-2637 is a medium-severity cross-site scripting vulnerability in Opensuse Opensuse, published on 12 Feb 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
Weakness: CWE-79
Which versions are affected by CVE-2013-2637?
It affects 3 products.
Products include Opensuse Opensuse, Otrs Faq, Otrs Otrs Itsm.
How do I fix CVE-2013-2637?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2013-2637 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-2637 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as GHSA-6cx5-8j63-3v47.