Security Advisory 2012-02

August 30, 2012 -- Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Security Advisory Details

Date: Aug 30, 2012
Title: XSS vulnerability in Firefox and Opera
Severity: less critical
Affected:
- OTRS Help Desk 2.4.x
- OTRS Help Desk 3.0.x
- OTRS Help Desk 3.1.x
Fixed in:
- OTRS 2.4.14, 3.0.16, 3.1.10
Common Vulnerabilities and Exposures: CVE-2012-4600

Vulnerability Description

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email in Firefox and Opera. In this case this is achieved with an invalid HTML structure with nested tags.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including 3.1.9 in combination with Firefox and Opera.