oss-security - CVE Request: OTRS: execution of JavaScript in OTRS context by opening malicious attachment

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161101135601.GA990@lorien.valinor.li>
Date: Tue, 1 Nov 2016 14:56:01 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Subject: CVE Request: OTRS: execution of JavaScript in OTRS context by
 opening malicious attachment

Hi

>From the OTRS advisory at [1]:

> An attacker could trick an authenticated agent or customer into
> opening a malicious attachment which could lead to the execution of
> JavaScript in OTRS context.

which is fixed in upstream versions OTRS 3.3.16 4.0.19 and 5.0.14.

 [1]  https://www.otrs.com/security-advisory-2016-02-security-update-otrs/

Could you please assign a CVE for this issue?

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.