CVE-2023-38057

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-380584.3An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perfor CVE-2023-380595.3The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be us CVE-2023-38069.8A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an CVE-2023-380608.8Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS CVE-2023-380615.4In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible CVE-2023-380626.5In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations CVE-2023-380635.4In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible CVE-2023-380646.5In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log CVE-2023-380655.4In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible CVE-2023-380666.1In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads CVE-2023-380676.5In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log CVE-2023-380687.3In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms