Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade otrs2 | Jul 30, 2024 | Aug 23, 2012 |
| Freebsd | — | Upgrade otrs | Dec 10, 2025 | Dec 30, 2012 |
| Suse | — | Upgrade otrsUpgrade otrs-docUpgrade otrs-itsm | Dec 12, 2013 | Aug 23, 2012 |
| Ubuntu | — | Upgrade otrs2 | Nov 19, 2024 | Aug 23, 2012 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub