Vulnerability CVE-2013-4718

Vulnerability Name:

CVE-2013-4718 (CCN-85510)

Assigned:

2013-07-09

Published:

2013-07-09

Updated:

2021-08-17

Summary:

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search.

CVSS v3 Severity:

5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2013-4718

Source: CCN
Type: SA52623
OTRS / OTRS ITSM Unspecified Script Insertion and SQL Injection Vulnerabilities

Source: CCN
Type: OTRS Web site
OTRS Help Desk software - OTRS IT Service Management software - Free Open Source Help Desk - Problem Management System - Customer Interaction Software | OTRS

Source: CCN
Type: Security Advisory 2013-05
Sql Injection + Xss Issue

Source: CCN
Type: BID-61036
Multiple OTRS Products CVE-2013-4718 Unspecified HTML Injection Vulnerability

Source: XF
Type: UNKNOWN
otrs-cve20134718-xss(85510)

Source: CCN
Type: OTRS Security Advisory 2013-05
OTRS

Source: MISC
Type: Patch, Vendor Advisory
https://web.archive.org/web/20130817120539/http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2013-05/

Vulnerable Configuration:

Configuration 1:

cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 3.0.0 and <= 3.0.21)

OR cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 3.1.0 and <= 3.1.17)

OR cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 3.2.0 and <= 3.2.8)

OR cpe:/a:otrs:otrs_itsm:*:*:*:*:*:*:*:* (Version >= 3.0.0 and <= 3.0.8)

OR cpe:/a:otrs:otrs_itsm:*:*:*:*:*:*:*:* (Version >= 3.1.0 and <= 3.1.9)

OR cpe:/a:otrs:otrs_itsm:*:*:*:*:*:*:*:* (Version >= 3.2.0 and <= 3.2.6)

Configuration CCN 1:

cpe:/a:otrs:otrs:3.2.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_itsm:3.2.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_itsm:3.0.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.1.17:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.21:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20134718	V	CVE-2013-4718	2022-06-30
oval:org.opensuse.security:def:113077	P	otrs-3.3.16-37.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106514	P	Security update for apache2 (Important) (in QA)	2022-01-10

BACK