Total vulnerabilities in the database
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
| Software | From | Fixed in |
|---|---|---|
| otrs / otrs | 6.0.0 | 6.0.26.x |
| otrs / otrs | 5.0.0 | 5.0.41.x |
| otrs / otrs | 7.0.0 | 7.0.15.x |