CVE-2018-11563

Vulnerability

An issue exists in Open Ticket Request System (OTRS) 6.0.x through version 6.0.7. A carefully constructed email can inject and execute arbitrary stylesheet or JavaScript code in the context of the OTRS customer panel application [1]. The vulnerability is triggered when a logged-in customer views the malicious email [1].

Exploitation

An attacker must send a specially crafted email to a target user who is logged into the OTRS customer panel. No special network position or authentication beyond the ability to send an email is required. The victim does not need to take any action beyond opening or viewing the email in the customer panel interface [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript (or CSS) in the victim's browser within the OTRS customer panel application context. This can lead to information disclosure (e.g., session tokens, customer data), UI manipulation, or other actions available in the customer panel session [1].

Mitigation

OTRS 6.0.x is end-of-life (EOL) and no longer receives official security fixes or vendor support [1]. No patched version for the 6.x series exists. The vendor recommends upgrading to the current supported OTRS version to receive security updates [1]. No workaround is documented in the available references.