{"id":"CVE-2023-5421","state":"PUBLISHED","title":"Possible XSS execution in customer information","description":"An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs \nimmediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.\nThis issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.\n\n","publishedAt":"2023-10-16T08:10:55.114Z","updatedAt":"2024-09-16T16:55:01.099Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","source":"OTRS"},"assigner":"OTRS","products":["OTRS AG OTRS","OTRS AG ((OTRS)) Community Edition"],"affected":[{"vendor":"OTRS AG","product":"OTRS","defaultStatus":"affected","versions":[{"version":"7.0.x","status":"affected","lessThan":"7.0.47","versionType":"Patch"},{"version":"8.0.x","status":"affected","lessThan":"8.0.37","versionType":"Patch"}],"modules":["Agent Interface"]},{"vendor":"OTRS AG","product":"((OTRS)) Community Edition","defaultStatus":"affected","versions":[{"version":"6.0.x","status":"affected","lessThanOrEqual":"6.0.34","versionType":"All"}],"modules":["Agent Interface"]}],"references":["https://otrs.com/release-notes/otrs-security-advisory-2023-09/"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/5xxx/CVE-2023-5421.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-5421","state":"PUBLISHED","datePublished":"2023-10-16T08:10:55.114Z","dateUpdated":"2024-09-16T16:55:01.099Z","assignerShortName":"OTRS","assignerOrgId":"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8","dateReserved":"2023-10-05T08:12:09.849Z"},"containers":{"cna":{"title":" Possible XSS execution in customer information ","descriptions":[{"lang":"en","value":"An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs \nimmediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.\nThis issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.\n\n"}],"affected":[{"vendor":"OTRS AG","product":"OTRS","defaultStatus":"affected","versions":[{"version":"7.0.x","status":"affected","lessThan":"7.0.47","versionType":"Patch"},{"version":"8.0.x","status":"affected","lessThan":"8.0.37","versionType":"Patch"}],"modules":["Agent Interface"]},{"vendor":"OTRS AG","product":"((OTRS)) Community Edition","defaultStatus":"affected","versions":[{"version":"6.0.x","status":"affected","lessThanOrEqual":"6.0.34","versionType":"All"}],"modules":["Agent Interface"]}],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2023-09/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"OTRS","orgId":"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8","dateUpdated":"2023-10-16T08:10:55.114Z"},"credits":[{"lang":"en","type":"finder","value":"Special thanks to Tim Püttmanns for reporting these vulnerability."}],"datePublic":"2023-10-16T07:00:00.000Z","impacts":[{"capecId":"CAPEC-63","descriptions":[{"lang":"en","value":"CAPEC-63 Cross-Site Scripting (XSS)"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\nUpdate to OTRS 7.0.47 or OTRS 8.0.37.\n<br>"}],"value":"Update to OTRS 7.0.47 or OTRS 8.0.37.\n\n"}],"source":{"advisory":"OSA-2023-09","defect":["Issue#1214","Ticket#2023080742002233"],"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Switch AdminCustomerUser::UseAutoComplete off<br>"}],"value":"Switch AdminCustomerUser::UseAutoComplete off\n"}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2023-09/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:59:44.593Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-16T16:53:50.683230Z","id":"CVE-2023-5421","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-16T16:55:01.099Z"}}]}}}