← Back

CVE-2013-2637

nvd nist
Published: Feb 12, 2020Modified: Nov 21, 2024

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.

Affected (7)

Otrs
2 products
Faq
Otrs Itsm
Opensuse
1 product
Opensuse
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Otrs
Faq
Before 2.0.8
Faq
From 2.1.0 to 2.1.4
Otrs
Otrs Itsm
Before 3.0.7
Otrs Itsm
From 3.1.0 to 3.1.8
Otrs Itsm
From 3.2.0 to 3.2.4
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Opensuse
Opensuse
Version 12.2
Opensuse
Version 12.3

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
ExploitThird Party AdvisoryVDB Entry
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry

Timeline

No history available yet.