CVE-2013-4718

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Open Ticket Request System (OTRS) ITSM module's ConfigItem search functionality. Remote authenticated users with a valid agent login can inject arbitrary web script or HTML by manipulating URLs. This affects OTRS ITSM versions 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 [1].

Exploitation

An attacker must possess a valid agent login to the OTRS system. The attack is performed by crafting a malicious URL containing JavaScript payloads in the ITSM ConfigItem search parameter. When the target agent visits the manipulated URL, the injected script executes in the context of the victim's browser session. No user interaction beyond clicking the crafted link is required [1].

Impact

Successful exploitation allows the attacker to execute JavaScript code in the context of the victim's OTRS session. This can lead to session hijacking, unauthorized actions, or theft of sensitive information displayed within the OTRS interface. The compromise is limited to the privileges of the victim agent [1].

Mitigation

OTRS has released fixed versions: OTRS ITSM 3.0.9, 3.1.10, and 3.2.7. Administrators should upgrade to these versions or later. The advisory notes that OTRS core versions up to 3.2.8 are not directly affected for this specific XSS but should also be kept up to date [1]. No workaround is provided; upgrading is the recommended action.