CVE-2023-38057 XSS stored in survey answers
Attackers can inject JavaScript into survey answers, leading to cross-site scripting attacks against authenticated agents reading the replies.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-38057?
CVE-2023-38057 is a medium-severity cross-site scripting vulnerability in ((OTRS)) Community Edition, published on 24 Jul 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
Which versions are affected by CVE-2023-38057?
It affects 1 product.
Products include Otrs Survey.
How do I fix CVE-2023-38057?
No fix has been published for CVE-2023-38057 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-38057 being exploited?
There is no known exploitation of CVE-2023-38057 in the wild and no public exploit code.
Other vulnerabilities in ((OTRS)) Community Edition
Sources
Also known as GHSA-48q8-4r5f-p5pf, UBUNTU-CVE-2023-38057.