CVE-2019-9752 Cross-site scripting in n/a

What is CVE-2019-9752?

CVE-2019-9752 is a medium-severity cross-site scripting vulnerability in Opensuse Backports Sle, published on 13 Mar 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.

Weakness: CWE-79

Which versions are affected by CVE-2019-9752?

It affects 3 products.

Products include Opensuse Backports Sle, Opensuse Leap, Otrs Otrs.

How do I fix CVE-2019-9752?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-9752 being exploited?

There is no known exploitation of CVE-2019-9752 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Backports Sle

• CVE-2020-12641 Roundcube Webmail Remote Code Execution Exploited Critical 9.8
• CVE-2020-12640 Path traversal in n/a Critical 9.8
• CVE-2020-8233 Command injection in EdgeSwitch firmware v1.9.0 and prior High 8.8
• CVE-2020-8026 inn: non-root owned files High 8.4
• CVE-2020-15229 Path traversal and files overwrite with unsquashfs High 8.2

All Opensuse Backports Sle vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-9752, DLA-1721-1, GHSA-246f-fqrw-2v49, UBUNTU-CVE-2019-9752.