CVE-2013-2637

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

4.30%

Published

Feb 12, 2020

Modified

Nov 20, 2024

Public PoC / Exploit (1)

All weaponized →

Exploit-DBOTRS 3.x - FAQ Module Persistent Cross-Site Scripting

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (7)

otrs · faq (up to 2.0.8)vulnerable

otrs · faq (up to 2.1.4)vulnerable

otrs · otrs_itsm (up to 3.0.7)vulnerable

otrs · otrs_itsm (up to 3.1.8)vulnerable

otrs · otrs_itsm (up to 3.2.4)vulnerable

opensuse · opensusevulnerable

References (8)

http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html

Mailing ListThird Party Advisory

http://www.exploit-db.com/exploits/24922

ExploitThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/58930

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/83288

Third Party AdvisoryVDB Entry

http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html

Mailing ListThird Party Advisory

http://www.exploit-db.com/exploits/24922

ExploitThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/58930

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/83288

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs