Vulnerability CVE-2011-1518

Vulnerability Name:

CVE-2011-1518 (CCN-66698)

Assigned:

2011-03-12

Published:

2011-03-12

Updated:

2017-08-17

Summary:

Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-1518

Source: SUSE
Type: UNKNOWN
SUSE-SR:2011:009

Source: CCN
Type: OTRS Web site
OTRS::Email Management::Trouble Ticket System::Welcome!

Source: CCN
Type: OTRS Security Advisory 2011-01
Several XSS attacks possible

Source: CONFIRM
Type: Vendor Advisory
http://otrs.org/advisory/OSA-2011-01-en/

Source: CCN
Type: SA44029
OTRS Cross-Site Scripting Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
44029

Source: SECUNIA
Type: UNKNOWN
44479

Source: DEBIAN
Type: UNKNOWN
DSA-2231

Source: DEBIAN
Type: DSA-2231
otrs2 -- cross-site scripting

Source: OSVDB
Type: UNKNOWN
71790

Source: CCN
Type: OSVDB ID: 71790
OTRS Multiple Unspecified XSS

Source: BID
Type: UNKNOWN
47323

Source: CCN
Type: BID-47323
OTRS Multiple Unspecified Cross-Site Scripting Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2011-1186

Source: XF
Type: UNKNOWN
otrs-multiple-unspecified-xss(66698)

Source: XF
Type: UNKNOWN
otrs-multiple-unspecified-xss(66698)

Source: SUSE
Type: SUSE-SR:2011:009
SUSE Security Summary Report

Vulnerable Configuration:

Configuration 1:

cpe:/a:otrs:otrs:2.4.0:beta1:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.0:beta2:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.0:beta3:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.0:beta4:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.0:beta5:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.0:beta6:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.5:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.7:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.4.9:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:otrs:otrs:3.0.0:beta1:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.0:beta2:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.0:beta3:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.0:beta4:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.0:beta5:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.0:beta6:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.0:beta7:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.5:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.6:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:otrs:otrs:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:2.3.5:*:*:*:*:*:*:*