Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade otrs2 | Jul 30, 2024 | Oct 22, 2012 |
| Freebsd | — | Upgrade otrs | Dec 10, 2025 | Dec 30, 2012 |
| Suse | — | Upgrade otrsUpgrade otrs-itsmUpgrade otrs-doc | Dec 12, 2013 | Oct 22, 2012 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub