CVE-2019-16375

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the article body handling of the Open Ticket Request System (OTRS). In affected versions, an authenticated user with appropriate permissions can craft an article body containing malicious JavaScript code. This code is stored and later executed when an agent composes an answer to that original article. Affected versions are OTRS 7.0.x through 7.0.11, Community Edition 6.0.x through 6.0.22, and Community Edition 5.0.x through 5.0.37 [1][2].

Exploitation

An attacker must be logged in as an agent or customer user and possess the necessary permissions to create or modify ticket articles. The attacker then inserts a carefully crafted string containing malicious JavaScript into the article body. When another agent subsequently composes an answer to that article (for example, by clicking "Reply"), the malicious script executes in the agent's browser session [2]. No additional user interaction beyond the standard reply workflow is required.

Impact

Successful exploitation leads to stored XSS, allowing the attacker to execute arbitrary JavaScript in the context of the victim agent's OTRS session. This could enable actions such as performing unauthorized operations with the agent's privileges, accessing sensitive ticket data, or modifying ticket content. The CVSS v3 base score is 3.2 (Low), with a vector of AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, indicating low impact to integrity only, within a single user scope [2].

Mitigation

The vulnerability is fixed in OTRS 7.0.12, OTRS 6.0.23, and OTRS 5.0.38, released on 2019-09-03 [2]. Users of supported versions should upgrade immediately. For OTRS 6.0.x Community Edition, note that version 6.0.x is end-of-life and no longer receives official security fixes; OTRS strongly recommends migrating to the current OTRS product [1]. No other workarounds are disclosed in the available references.