Multiple OTRS Products CVE-2013-4718 Unspecified HTML Injection Vulnerability

Bugtraq ID:	61036
Class:	Input Validation Error
CVE:	CVE-2013-4718
Remote:	Yes
Local:	No
Published:	Jul 09 2013 12:00AM
Updated:	Aug 14 2013 04:06PM
Credit:	The vendor reported this issue.
Vulnerable:	OTRS OTRS 3.0.10 OTRS OTRS 3.0.7 OTRS OTRS 3.0.6 OTRS OTRS 3.0.5 OTRS OTRS 3.0.4 OTRS OTRS 3.0.3 OTRS OTRS 3.0.2 OTRS OTRS 3.0.1
Not Vulnerable:

Multiple OTRS Products CVE-2013-4718 Unspecified HTML Injection Vulnerability

Multiple OTRS products are prone to an unspecified HTML-injection vulnerability because it fails to sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

Multiple OTRS Products CVE-2013-4718 Unspecified HTML Injection Vulnerability

An attacker can exploit the issue using a browser.

Multiple OTRS Products CVE-2013-4718 Unspecified HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple OTRS Products CVE-2013-4718 Unspecified HTML Injection Vulnerability

References:

• OTRS Homepage (OTRS )