Vulnerability CVE-2019-10066

Vulnerability Name:

CVE-2019-10066 (CCN-161456)

Assigned:

2019-04-26

Published:

2019-04-26

Updated:

2019-05-22

Summary:

An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment in order to cause execution of JavaScript in the context of OTRS.

CVSS v3 Severity:

5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
4.1 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2019-10066

Source: CCN
Type: OTRS Web site
Security Advisory 2019-06: Security Update for OTRS Framework

Source: CONFIRM
Type: Patch, Vendor Advisory
https://community.otrs.com/security-advisory-2019-06-security-update-for-otrs-framework/

Source: XF
Type: UNKNOWN
otrs-cve201910066-xss(161456)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-10066

Vulnerable Configuration:

Configuration 1:

cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 5.0.0 and <= 5.0.12)

OR cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 6.0.0 and <= 6.0.17)

OR cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 7.0.0 and <= 7.0.6)

Configuration CCN 1:

cpe:/a:otrs:otrs:7.0.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:6.0.17:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:2019100660000000	V	CVE-2019-10066 on Ubuntu 18.04 LTS (bionic) - low.	2019-05-22
oval:com.ubuntu.disco:def:2019100660000000	V	CVE-2019-10066 on Ubuntu 19.04 (disco) - low.	2019-05-22
oval:com.ubuntu.xenial:def:2019100660000000	V	CVE-2019-10066 on Ubuntu 16.04 LTS (xenial) - low.	2019-05-21
oval:com.ubuntu.cosmic:def:2019100660000000	V	CVE-2019-10066 on Ubuntu 18.10 (cosmic) - low.	2019-05-21
oval:com.ubuntu.cosmic:def:201910066000	V	CVE-2019-10066 on Ubuntu 18.10 (cosmic) - low.	2019-04-30
oval:com.ubuntu.bionic:def:201910066000	V	CVE-2019-10066 on Ubuntu 18.04 LTS (bionic) - low.	2019-04-30
oval:com.ubuntu.xenial:def:201910066000	V	CVE-2019-10066 on Ubuntu 16.04 LTS (xenial) - low.	2019-04-30

BACK