CVE-2024-43443 Stored XSS in process management
An admin can inject scripts into Process Management modules, allowing XSS attacks against other administrators in OTRS systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43443?
CVE-2024-43443 is a medium-severity cross-site scripting vulnerability in ((OTRS)) Community Edition, published on 26 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the Process Management targeting other admins. This issue affects:
* OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
Weakness: CWE-790
Which versions are affected by CVE-2024-43443?
How do I fix CVE-2024-43443?
No fix has been published for CVE-2024-43443 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-43443 being exploited?
There is no known exploitation of CVE-2024-43443 in the wild and no public exploit code.
Sources
Also known as GHSA-79g4-f35r-g3f6, UBUNTU-CVE-2024-43443.