Test ID:	1.3.6.1.4.1.25623.1.0.803934
Category:	Web application abuses
Title:	OTRS Subaction XSS Vulnerability
Summary:	OTRS (Open Ticket Request System) is prone to a cross-site scripting (XSS) vulnerability.
Description:	Summary: OTRS (Open Ticket Request System) is prone to a cross-site scripting (XSS) vulnerability. Vulnerability Insight: An error exists in index.pl script which fails to validate user-supplied input to Subaction parameter properly. Vulnerability Impact: Successful exploitation will allow remote attackers to steal the victim's cookie-based authentication credentials. Affected Software/OS: OTRS (Open Ticket Request System) version 2.0.1 to 2.0.4 Solution: Upgrade to OTRS (Open Ticket Request System) version 2.0.5 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-2524 BugTraq ID: 23862 http://www.securityfocus.com/bid/23862 Bugtraq: 20070507 OTRS <= 2.0.x XSS/XSRF (Google Search) http://www.securityfocus.com/archive/1/467870/100/0/threaded Bugtraq: 20070611 Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial ofservice (Google Search) http://www.securityfocus.com/archive/1/471192/100/0/threaded Debian Security Information: DSA-1298 (Google Search) http://www.debian.org/security/2007/dsa-1298 http://www.virtuax.be/?page=library&id=35&type=Exploits http://osvdb.org/35821 http://osvdb.org/35822 http://secunia.com/advisories/25205 http://secunia.com/advisories/25419 http://secunia.com/advisories/25787 http://securityreason.com/securityalert/2668 SuSE Security Announcement: SUSE-SR:2007:013 (Google Search) http://www.novell.com/linux/security/advisories/2007_13_sr.html http://www.vupen.com/english/advisories/2007/1698 XForce ISS Database: otrs-indexpl-xss(34164) https://exchange.xforce.ibmcloud.com/vulnerabilities/34164
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.