CVE-2018-17883

NameCVE-2018-17883
DescriptionAn issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
otrs2 (PTS)bullseye/non-free6.0.32-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
otrs2sourcejessie(not affected)
otrs2sourcestretch(not affected)
otrs2source(unstable)6.0.12-1

Notes

[stretch] - otrs2 <not-affected> (Only affects 6.x)
[jessie] - otrs2 <not-affected> (Only affects 6.x)
https://community.otrs.com/security-advisory-2018-06-security-update-for-otrs-framework/
https://github.com/OTRS/otrs/commit/40bbcc261a77c2f4c0383658cd99c07d577179ce
Search for package or bug name: Reporting problems