CVE-2020-1766CWE-79

Improper handling of uploaded inline images

Low · published January 10, 2020

CVSS v3.1
2.0
EPSS
1%
Percentile
68.8
In the wild
Unconfirmed
What it is

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.

The record
Technical detail
CVSS v3.1
2.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01233 · 68.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-01-10T15:08Z
EPSS history
Timeline
  • 10 JAN 15:08Z
    Improper handling of uploaded inline images
    cvelistv5