CVE-2012-4600

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags.

Published Bycve@mitre.org

Published DateAug 31, 2012, 14:55

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

2.6

Vector String

AV:N/AC:H/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://secunia.com/advisories/50615
http://www.kb.cert.org/vuls/id/511404
http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2012-02/
http://znuny.com/en/#%21/advisory/ZSA-2012-02

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

2.6

Vector String

AV:N/AC:H/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE