CVE ID:	CVE-2005-3894
Description:	Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) hex-encoded values in the QueueID parameter and (2) Action parameters.
Test IDs:	1.3.6.1.4.1.25623.1.0.56281
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2005-3894 BugTraq ID: 15537 http://www.securityfocus.com/bid/15537/ Bugtraq: 20051122 OTRS 1.x/2.x Multiple Security Issues (Google Search) http://marc.info/?l=bugtraq&m=113272360804853&w=2 Debian Security Information: DSA-973 (Google Search) http://www.debian.org/security/2006/dsa-973 http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/039001.html http://moritz-naumann.com/adv/0007/otrsmulti/0007.txt http://www.osvdb.org/21067 http://securitytracker.com/id?1015262 http://secunia.com/advisories/17685/ http://secunia.com/advisories/18101 http://secunia.com/advisories/18887 SuSE Security Announcement: SUSE-SR:2005:030 (Google Search) http://www.novell.com/linux/security/advisories/2005_30_sr.html http://www.vupen.com/english/advisories/2005/2535 XForce ISS Database: otrs-index-xss(23359) https://exchange.xforce.ibmcloud.com/vulnerabilities/23359 XForce ISS Database: otrs-queue-selection-xss(23356) https://exchange.xforce.ibmcloud.com/vulnerabilities/23356