CVE-2022-0475

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and prior versions.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
OTRS AG	OTRS	>= 7.0.x, <= 7.0.32; >= 8.0.x, <= 8.0.19

References

https://otrs.com/release-notes/otrs-security-advisory-2022-05/Release Notes, Vendor Advisory
https://otrs.com/release-notes/otrs-security-advisory-2022-05/Release Notes, Vendor Advisory

Timeline

Published: Mar 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04765.5Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.CVE-2022-04774.9An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.CVE-2022-04788.8The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg p CVE-2022-04799.8The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a S CVE-2022-04805.5A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg CVE-2022-04817.5NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-04829.1Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.CVE-2022-04837.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before buil CVE-2022-04848.8Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default bro CVE-2022-04854.8A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was bl CVE-2022-04867.8Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker CVE-2022-04875.5A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. I