CVE-2022-39049

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
OTRS AGOTRS>= 7.0.x, <= 7.0.36; >= 8.0.x, <= 8.0.24
OTRS AG((OTRS)) Community Edition>= 6.0.1, < 6.0.x*

References

Timeline

Published
Sep 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-390504.8An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any otherCVE-2022-390518.8Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party packagCVE-2022-390526.5An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the systemCVE-2022-390536.1Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (CVE-2022-390546.1Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthenticated remote attacCVE-2022-390555.3RAVA certificate validation system has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform SSRF attack toCVE-2022-390569.8RAVA certificate validation system has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL cCVE-2022-390577.2RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with admiCVE-2022-390587.5RAVA certification validation system has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability tCVE-2022-390597.5ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote aCVE-2022-39064.8The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege userCVE-2022-390609.8ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit
CVE-2022-39049: Medium severity, CVSS 4.8 | Vulnix