Software Engineering Institute

Open Technology Real Services (OTRS) contains a cross-site scripting (CWE-79) vulnerability in the email body. An attacker may be able to load arbitrary script in the context of the user's browser when they view a specifically crafted email message containing an invalid HTML structure with nested tags.

Proof-of-Concept:

<s<script>...</script><script>...<cript type="text/javascript">
document.write("Hello World!");
alert('Mike was here!');;
</s<script>//<cript>

Additional details may be found in the OTRS advisory.

An attacker may be able to execute arbitrary script in the context of the user's browser.

Apply an Update

The OTRS advisory states: This vulnerability is fixed in OTRS 2.4.14, 3.0.16 and 3.1.10 and it is recommended to upgrade to one of these versions.