CVE-2022-39050 Possible XSS stored in customer information
An admin can inject JavaScript into customer URL fields, leading to stored XSS execution for other agents within the OTRS application context.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-39050?
CVE-2022-39050 is a medium-severity cross-site scripting vulnerability in Otrs Otrs, published on 5 Sep 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap
Weakness: CWE-79
Which versions are affected by CVE-2022-39050?
It affects 1 product.
Products include Otrs Otrs.
How do I fix CVE-2022-39050?
No fix has been published for CVE-2022-39050 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-39050 being exploited?
There is no known exploitation of CVE-2022-39050 in the wild and no public exploit code.
Other vulnerabilities in Otrs Otrs
Sources
Also known as GHSA-x46q-hjvj-45vc, UBUNTU-CVE-2022-39050.