CVE-2020-1766
Fixed in a distro release EPSS 1%CVSS 2.0
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
Products: OTRS AG ((OTRS)) Community Edition, OTRS AG OTRS
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | otrs2 | 6.0.16-2+deb10u1 |
| Debian 11 | otrs2 | 6.0.25-1 |
| Debian 8 | otrs2 | 3.3.18-1+deb8u13 |
| SUSE Package Hub 15 | otrs | 5.0.42-bp151.3.3.1 |
| SUSE Package Hub 15 SP1 | otrs | 6.0.29-bp152.2.5.4 |
| SUSE Package Hub 15 SP1 | otrs | 5.0.42-bp151.3.3.1 |
| SUSE Package Hub 15 SP2 | otrs | 6.0.29-bp152.2.5.4 |
| SUSE Package Hub 15 SP2 | otrs | 6.0.29-bp152.2.8.1 |
| Ubuntu 16.04 LTS | otrs2 | no fix |
| Ubuntu 18.04 LTS | otrs2 | no fix |
| openSUSE Leap 15.1 | otrs | 5.0.42-bp151.3.3.1 |
| openSUSE Leap 15.1 | otrs | 6.0.29-bp152.2.5.4 |
| openSUSE Leap 15.2 | otrs | 6.0.29-bp152.2.5.4 |