CVE - CVE-2007-2524

CVE-ID
CVE-2007-2524	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:23862 URL:http://www.securityfocus.com/bid/23862 BUGTRAQ:20070507 OTRS <= 2.0.x XSS/XSRF URL:http://www.securityfocus.com/archive/1/467870/100/0/threaded BUGTRAQ:20070611 Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial ofservice URL:http://www.securityfocus.com/archive/1/471192/100/0/threaded DEBIAN:DSA-1298 URL:http://www.debian.org/security/2007/dsa-1298 MISC:http://www.virtuax.be/?page=library&id=35&type=Exploits OSVDB:35821 URL:~~http://osvdb.org/35821~~ (Obsolete source) OSVDB:35822 URL:~~http://osvdb.org/35822~~ (Obsolete source) SECUNIA:25205 URL:http://secunia.com/advisories/25205 SECUNIA:25419 URL:http://secunia.com/advisories/25419 SECUNIA:25787 URL:http://secunia.com/advisories/25787 SREASON:2668 URL:http://securityreason.com/securityalert/2668 SUSE:SUSE-SR:2007:013 URL:http://www.novell.com/linux/security/advisories/2007_13_sr.html VUPEN:ADV-2007-1698 URL:~~http://www.vupen.com/english/advisories/2007/1698~~ (Obsolete source) XF:otrs-indexpl-xss(34164) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/34164
Assigning CNA
MITRE Corporation
Date Record Created
20070508	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070508)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)