Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.
2012-08-23T10:32:14.967
2025-04-11T00:51:21.963
Deferred
CVSSv2: 4.3 (MEDIUM)
AV:N/AC:M/Au:N/C:N/I:P/A:N
8.6
2.9
Type | Vendor | Product | Version/Range | Vulnerable? |
---|---|---|---|---|
Application | otrs | otrs | 2.4.0 | Yes |
Application | otrs | otrs | 2.4.0 | Yes |
Application | otrs | otrs | 2.4.0 | Yes |
Application | otrs | otrs | 2.4.0 | Yes |
Application | otrs | otrs | 2.4.0 | Yes |
Application | otrs | otrs | 2.4.0 | Yes |
Application | otrs | otrs | 2.4.1 | Yes |
Application | otrs | otrs | 2.4.2 | Yes |
Application | otrs | otrs | 2.4.3 | Yes |
Application | otrs | otrs | 2.4.4 | Yes |
Application | otrs | otrs | 2.4.5 | Yes |
Application | otrs | otrs | 2.4.6 | Yes |
Application | otrs | otrs | 2.4.7 | Yes |
Application | otrs | otrs | 2.4.8 | Yes |
Application | otrs | otrs | 2.4.9 | Yes |
Application | otrs | otrs | 2.4.10 | Yes |
Application | otrs | otrs | 2.4.11 | Yes |
Application | otrs | otrs | 2.4.12 | Yes |
Application | otrs | otrs | 3.0.0 | Yes |
Application | otrs | otrs | 3.0.0 | Yes |
Application | otrs | otrs | 3.0.0 | Yes |
Application | otrs | otrs | 3.0.0 | Yes |
Application | otrs | otrs | 3.0.0 | Yes |
Application | otrs | otrs | 3.0.0 | Yes |
Application | otrs | otrs | 3.0.0 | Yes |
Application | otrs | otrs | 3.0.1 | Yes |
Application | otrs | otrs | 3.0.2 | Yes |
Application | otrs | otrs | 3.0.3 | Yes |
Application | otrs | otrs | 3.0.4 | Yes |
Application | otrs | otrs | 3.0.5 | Yes |
Application | otrs | otrs | 3.0.6 | Yes |
Application | otrs | otrs | 3.0.7 | Yes |
Application | otrs | otrs | 3.0.8 | Yes |
Application | otrs | otrs | 3.0.9 | Yes |
Application | otrs | otrs | 3.0.10 | Yes |
Application | otrs | otrs | 3.0.11 | Yes |
Application | otrs | otrs | 3.0.12 | Yes |
Application | otrs | otrs | 3.0.13 | Yes |
Application | otrs | otrs | 3.0.14 | Yes |
Application | otrs | otrs | 3.1.0 | Yes |
Application | otrs | otrs | 3.1.1 | Yes |
Application | otrs | otrs | 3.1.2 | Yes |
Application | otrs | otrs | 3.1.3 | Yes |
Application | otrs | otrs | 3.1.4 | Yes |
Application | otrs | otrs | 3.1.5 | Yes |
Application | otrs | otrs | 3.1.6 | Yes |
Application | otrs | otrs | 3.1.7 | Yes |
Application | otrs | otrs | 3.1.8 | Yes |
Application | otrs | otrs_itsm | 2.1.0 | Yes |
Application | otrs | otrs_itsm | 2.1.1 | Yes |
Application | otrs | otrs_itsm | 2.1.2 | Yes |
Application | otrs | otrs_itsm | 2.1.3 | Yes |
Application | otrs | otrs_itsm | 2.1.4 | Yes |
Application | otrs | otrs_itsm | 3.0.0 | Yes |
Application | otrs | otrs_itsm | 3.0.1 | Yes |
Application | otrs | otrs_itsm | 3.0.2 | Yes |
Application | otrs | otrs_itsm | 3.0.3 | Yes |
Application | otrs | otrs_itsm | 3.0.4 | Yes |
Application | otrs | otrs_itsm | 3.0.5 | Yes |
Application | otrs | otrs_itsm | 3.1.0 | Yes |
Application | otrs | otrs_itsm | 3.1.1 | Yes |
Application | otrs | otrs_itsm | 3.1.2 | Yes |
Application | otrs | otrs_itsm | 3.1.3 | Yes |
Application | otrs | otrs_itsm | 3.1.4 | Yes |
Application | otrs | otrs_itsm | 3.1.5 | Yes |