CVE-2019-10067

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Open Ticket Request System (OTRS) versions 7.x through 7.0.6, Community Edition 5.0.x through 5.0.35, and Community Edition 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS [1].

Exploitation

An attacker must be an authenticated agent with sufficient permissions. By crafting a malicious URL and tricking a victim (or themselves) into accessing it, the attacker can inject arbitrary JavaScript into the OTRS interface. The exact sequence involves constructing a URL that passes JavaScript code through a parameter, which is then reflected or processed without sanitization [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the OTRS session. This can lead to unauthorized actions, data exfiltration, or session hijacking, depending on the attacker's goals and the victim's privileges [1].

Mitigation

OTRS has released updates to address this vulnerability. Affected users should upgrade to OTRS 7.0.7 or later, Community Edition 5.0.36 or later, or Community Edition 6.0.18 or later. As of the publication date, no workaround is documented. Note that OTRS Community Edition 6.x is end-of-life and no longer receives official security fixes [1].