CVE-2007-2524

Description

Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/34164

http://www.vupen.com/english/advisories/2007/1698

http://www.securityfocus.com/archive/1/471192/100/0/threaded

http://www.securityfocus.com/archive/1/467870/100/0/threaded

http://www.novell.com/linux/security/advisories/2007_13_sr.html

http://www.debian.org/security/2007/dsa-1298

http://securityreason.com/securityalert/2668

http://secunia.com/advisories/25787

http://secunia.com/advisories/25419

http://secunia.com/advisories/25205

http://osvdb.org/35822

http://osvdb.org/35821

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3