CVE-2019-9752
Fixed in a distro release EPSS 1%
An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.
Products: otrs, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | otrs2 | 6.0.16-1 |
| Debian 8 | otrs2 | 3.3.18-1+deb8u8 |
| SUSE Package Hub 15 | otrs | 5.0.42-bp151.3.3.1 |
| SUSE Package Hub 15 SP1 | otrs | 5.0.42-bp151.3.3.1 |
| SUSE Package Hub 15 SP1 | otrs | 6.0.29-bp152.2.5.4 |
| SUSE Package Hub 15 SP2 | otrs | 6.0.29-bp152.2.5.4 |
| SUSE Package Hub 15 SP2 | otrs | 6.0.29-bp152.2.8.1 |
| Ubuntu 16.04 LTS | otrs2 | no fix |
| Ubuntu 18.04 LTS | otrs2 | no fix |
| openSUSE Leap 15.1 | otrs | 5.0.42-bp151.3.3.1 |
| openSUSE Leap 15.1 | otrs | 6.0.29-bp152.2.5.4 |
| openSUSE Leap 15.2 | otrs | 6.0.29-bp152.2.5.4 |