CVE-2020-1771

Published: 27 March 2020

Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

Priority

CVSS 3 base score: 5.4

Status

Package	Release	Status
otrs2 Launchpad, Ubuntu, Debian	Upstream	Needs triage

	Ubuntu 20.10 (Groovy Gorilla)	Not vulnerable (6.0.27-1)
	Ubuntu 20.04 LTS (Focal Fossa)	Needs triage
	Ubuntu 18.04 LTS (Bionic Beaver)	Needs triage
	Ubuntu 16.04 LTS (Xenial Xerus)	Needs triage
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
	Patches: Upstream: https://github.com/OTRS/otrs/commit/2576830053f70a3a9251558e55f34843dec61aa2

Notes

Author	Note
sbeattie	probably does not affect otrs v5

References

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM