Skip to content
CVE PROGRAM SOURCE RECORD2.0 Low

CVE-2020-1766

Improper handling of uploaded inline images

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OTRS

Description

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OTRS AG ((OTRS)) Community Edition

  • 5.0.x version 5.0.39 and prior versionsaffected
  • 6.0.x version 6.0.24 and prior versionsaffected

OTRS AG OTRS

  • 7.0.x version 7.0.13 and prior versionsaffected

References