CVE-2024-43442 Stored XSS in System Configuration
An admin can inject malicious scripts into the System Configuration module, allowing stored XSS attacks against other administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43442?
CVE-2024-43442 is a medium-severity cross-site scripting vulnerability in ((OTRS)) Community Edition, published on 26 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting other admins. This issue affects:
* OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
Which versions are affected by CVE-2024-43442?
How do I fix CVE-2024-43442?
No fix has been published for CVE-2024-43442 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-43442 being exploited?
There is no known exploitation of CVE-2024-43442 in the wild and no public exploit code.
Sources
Also known as GHSA-g24f-94pq-jr67, UBUNTU-CVE-2024-43442.