CVE-2020-1766

Katalog CVE

CVSS 6.1 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada otrs, debian linux. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.

Rincian

Terbit di NVD

10 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://otrs.com/release-notes/otrs-security-advisory-2020-02/ patch · advisory vendor
• https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html mailing list · not applicable · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html broken link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html broken link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html broken link
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html