CVE-2022-0475 - Possible XSS attack via translation

Back Back to CVE browser

MEDIUM

Possible XSS attack via translation

Published Mar 21, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.45%

Description

Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and prior versions.

Affected products

Vendor Otrs AG Product OTRS Default
n/a
- Version
  7.0.x
  Status
  affected
  Constraints
  <=7.0.32
- Version
  8.0.x
  Status
  affected
  Constraints
  <=8.0.19

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Otrs AG

OTRS

n/a

Version	Status	Constraints
7.0.x	affected	<=7.0.32
8.0.x	affected	<=8.0.19

Remediation

Vendor solution

Update to OTRS 7.0.33 and OTRS 8.0.20.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15613
Advisory
https://otrs.com/release-notes/otrs-security-advisory-2022-05/
x_refsource_CONFIRMRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15613		Advisory
https://otrs.com/release-notes/otrs-security-advisory-2022-05/		x_refsource_CONFIRMRelease NotesVendor Advisory