CVE-2012-4751

EPSS 5.8%

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 3

cve_referencepacketstormsecurity.org/files/117504/OTRS-3.1-Cross-Site-Scripting.htmlnão verificado exploitdbwww.exploit-db.com/exploits/22070não verificado exploitdbwww.exploit-db.com/exploits/20959não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://lists.opensuse.org/opensuse-updates/2013-01/msg00036.html http://packetstormsecurity.org/files/117504/OTRS-3.1-Cross-Site-Scripting.html http://www.kb.cert.org/vuls/id/603276 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/http://www.securityfocus.com/bid/56093 http://znuny.com/assets/proof_of_concept_cve_2012-4751-znuny.py http://znuny.com/en/#%21/advisory/ZSA-2012-03