CVE-2013-2637 EXPLOIT
6.1
MEDIUM · CVSS 3.1 · EPSS 4.3% (pctl 91)
Patch early
A public exploit exists.
Description
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
Scoring
| CVSS | 6.1 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 4.31% — more likely to be exploited than 91% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-02-12 |
| Last modified | 2026-06-16 |
Affected (3)
| Vendor | Product |
|---|---|
| opensuse | opensuse |
| otrs | faq |
| otrs | otrs itsm |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | OTRS 3.x - FAQ Module Persistent Cross-Site Scripting | 2013-04-08 |
References
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html
- http://www.exploit-db.com/exploits/24922
- http://www.securityfocus.com/bid/58930
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83288
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html
- http://www.exploit-db.com/exploits/24922
- http://www.securityfocus.com/bid/58930
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83288
→ the Explorer · watch your stack · NVD