Update OTRS to 3.2.15 (address XSS vulnerability)
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	pajz
	Feb 25 2014, 3:00 PM

Description

http://www.otrs.com/security-advisory-2014-03-xss-issue/

"An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed."

Version: wmf-deployment
Severity: normal

Details

Reference: bz61912

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 22 2014, 2:54 AM

• bzimport added a project: Znuny.

• bzimport set Reference to bz61912.

pajz created this task.Feb 25 2014, 3:00 PM

Thanks for reporting!

Jeff Green: Could you take a look at this?

I applied the patches for 3.2.x to buy us a little time to plan a a maintenance window for the upgrade.

RT 6916

Since patch-level updates can be skipped, bug 63685 should be fixed instead of this one.

closing 61912 since we patched to fix the main issue, and now have 63685 which supersedes

*** This bug has been marked as a duplicate of bug 63685 ***

Steinsplitter moved this task from Incoming to Resolved on the Znuny board.Mar 19 2015, 10:27 AM

Update OTRS to 3.2.15 (address XSS vulnerability)Closed, ResolvedPublicActions

Description

Details

Event Timeline

Update OTRS to 3.2.15 (address XSS vulnerability)
Closed, ResolvedPublic
Actions