Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Open Ticket Request System 2.x permits script injection in mailbox

CVE-2007-2524 · published 19 years ago
Summary

The web interface of Open Ticket Request System version 2.0 can be tricked into running unwanted code when a user opens a specific mailbox page. An attacker could insert malicious scripts that run in the victim's browser, potentially stealing data or altering the displayed information. Apply the latest security update from the vendor or restrict access to the affected page until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
otrs otrs 2.0.4
cpe:2.3:a:otrs:otrs:2.0.4:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an Agen...
Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
5% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published8 May 2007
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-2524 · NVD
Track software like this
Free during beta