OTRS ITSM/FAQ Module CVE-2013-2637 Multiple HTML Injection Vulnerabilities

Bugtraq ID:	58930
Class:	Input Validation Error
CVE:	CVE-2013-2637
Remote:	Yes
Local:	No
Published:	Apr 02 2013 12:00AM
Updated:	Aug 14 2013 04:06PM
Credit:	Luigi Vezzoso
Vulnerable:
Not Vulnerable:

OTRS ITSM/FAQ Module CVE-2013-2637 Multiple HTML Injection Vulnerabilities

OTRS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

The following versions are vulnerable:

OTRS ITSM versions prior to 3.2.4, 3.1.8, and 3.0.7
FAQ versions prior to 2.1.4 and 2.0.8.

OTRS ITSM/FAQ Module CVE-2013-2637 Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

OTRS ITSM/FAQ Module CVE-2013-2637 Multiple HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OTRS ITSM/FAQ Module CVE-2013-2637 Multiple HTML Injection Vulnerabilities

References:

• OTRS Homepage (OTRS)