CVE-2022-0473CWE-79

Dynamic field error message is vulnerable to XSS

Low · published February 7, 2022

CVSS v3.1
3.8
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00510 · 42.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-02-07T10:25Z
EPSS history
Timeline
  • 07 FEB 10:25Z
    Dynamic field error message is vulnerable to XSS
    cvelistv5