Possible XSS in Customer user address book

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the customer address book of OTRS Community Edition 6.0.26 and prior, and OTRS 7.0.15 and prior [1]. An attacker can craft an article containing a link to the customer address book with malicious JavaScript content. The vulnerability is caused by missing parameter encoding, allowing the injected script to be executed when the link is opened [1].

Exploitation

To exploit, the attacker must have access to create or modify articles in OTRS (i.e., be an authenticated user with appropriate permissions). The attacker embeds a crafted link containing JavaScript in an article. When an agent (typically a helpdesk staff member) opens that article and clicks the malicious link, the script executes in the agent's browser session [1]. No further user interaction required besides clicking the link.

Impact

Successful exploitation leads to execution of arbitrary JavaScript in the context of the victim agent's OTRS session. This can result in limited information disclosure (e.g., reading of session tokens or interface data) and limited manipulation of the interface (e.g., modifying displayed content) [1]. The CVSS vector indicates a medium severity with LOW impact on confidentiality and integrity, and NO impact on availability [1].

Mitigation

The issue is fixed in OTRS 7.0.16 and OTRS Community Edition 6.0.27 [1]. Administrators should upgrade to these patched versions immediately. No workarounds are mentioned in the available references. The fix is tracked as commit 2576830053f70a3a9251558e55f34843dec61aa2 for the Community Edition [1]. CVE-2020-1771 is not listed on the CISA KEV catalogue as of the advisory publication date.