CVE-2019-9752
13.03.2019, 22:29
An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.
| Vendor | Product | Version |
|---|---|---|
| otrs | otrs | 5.0.0 ≤ 𝑥 < 5.0.34 |
| otrs | otrs | 6.0.0 ≤ 𝑥 < 6.0.16 |
| otrs | otrs | 7.0.0 ≤ 𝑥 < 7.0.4 |
| opensuse | backports_sle | 15.0:sp1 |
| opensuse | backports_sle | 15.0:sp2 |
| opensuse | leap | 15.1 |
| opensuse | leap | 15.2 |
𝑥
= Vulnerable software versions
Ubuntu Releases
References