p PatchFirst

CVE-2023-5421

CVE-2023-5421 · Possible XSS execution in customer information

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.

CVSS 3.5 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • otrs

    Versions
    • ≥ 7.0.x, < 7.0.47: Affected (Patch)
    • ≥ 8.0.x, < 8.0.37: Affected (Patch)

    Update to 7.0.47; Update to 8.0.37

  • ((otrs)) community edition

    Versions
    • ≥ 6.0.x, ≤ 6.0.34: Affected (All)

    No fix published

  • otrs2 Ubuntu:16.04:LTS

    Versions
    • 4.0.10-1
    • 5.0.1-1
    • 5.0.1-2
    • 5.0.2-1
    • 5.0.3-1
    • 5.0.5-1
    • 5.0.6-1
    • 5.0.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • otrs2 Ubuntu:18.04:LTS

    Versions
    • 5.0.23-1
    • 5.0.24-1
    • 6.0.1-1
    • 6.0.2-1
    • 6.0.3-1
    • 6.0.4-1
    • 6.0.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • otrs2 Ubuntu:20.04:LTS

    Versions
    • 6.0.20-1
    • 6.0.23-2
    • 6.0.24-1
    • 6.0.25-1
    • 6.0.25-2
    • 6.0.25-3
    • 6.0.26-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • otrs2 Ubuntu:22.04:LTS

    Versions
    • 6.0.32-6
    • 6.1.2-1
    • 6.2.1-1
    • 6.2.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • znuny Ubuntu:24.04:LTS

    Versions
    • 6.5.3-1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • znuny Ubuntu:25.10

    Versions
    • 6.5.14-1
    • 6.5.15-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • znuny Ubuntu:26.10

    Versions
    • 6.5.18-1
    • 6.5.20-1
    • 6.5.21-1
    • 6.5.22-1
    • 6.5.23-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • znuny Ubuntu:26.04:LTS

    Versions
    • 6.5.15-2
    • 6.5.18-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →