CVE-2024-43442— Stored XSS in System Configuration
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-43442
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored XSS in System Configuration
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting other admins. This issue affects: * OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
特殊元素过滤不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
OTRS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OTRS是德国OTRS公司的一个服务管理解决方案。 OTRS存在安全漏洞，该漏洞源于具有管理员权限的攻击者对输入所做的不当无效化，允许在系统配置中针对其他管理员进行跨站脚本攻击。受影响版本如下：OTRS 7.0.X至7.0.50版本、OTRS 8.0.X版本、OTRS 2023.X版本、OTRS 2024.X至2024.5.X版本和OTRS Community Edition 6.0.x版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OTRS AG | OTRS | 7.0.x ~ 7.0.50 | - | |
| OTRS AG | ((OTRS)) Community Edition | 6.0.x | - |
II. Public POCs for CVE-2024-43442
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-43442
请登录查看更多情报信息。
Same Patch Batch · OTRS AG · 2024-08-26 · 3 CVEs total
| CVE-2024-43444 | 8.2 HIGH | Passwords are written to Admin Log Module |
| CVE-2024-43443 | 4.9 MEDIUM | Stored XSS in process management |
IV. Related Vulnerabilities
Same weakness: CWE-790
- CVE-2026-2328
Backend Access Due to Insufficient Input Validation - CVE-2025-27260
Ericsson Indoor Connect 8855 - Improper Filtering of Special - CVE-2025-0431
Enterprise Protection Backslash URL Rewrite Bypass - CVE-2024-47984
Dell RecoverPoint for Virtual Machines 安全漏洞 - CVE-2024-42416
Multiple issues in ctl(4) CAM Target Layer
V. Comments for CVE-2024-43442
No comments yet