CVE-2012-2582 | BDVDB-2026-51772 Detail

Description#

Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://lists.opensuse.org/opensuse-updates/2012-09/msg00024.html
http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01/
http://www.kb.cert.org/vuls/id/582879
http://secunia.com/advisories/50513
http://www.debian.org/security/2012/dsa-2536

Exploit#

No public exploit known

History#

Version 12012-08-23Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.