CVE-2024-43442

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting other admins. This issue affects:

* OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-790 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-434434.9Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS an CVE-2024-434448.2Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentic CVE-2024-434455.4A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. A CVE-2024-434463.5An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has CVE-2024-434478.1Windows SMBv3 Server Remote Code Execution Vulnerability CVE-2024-434496.8Windows USB Video Class System Driver Elevation of Privilege Vulnerability CVE-2024-43459.8The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the CVE-2024-434507.5Windows DNS Spoofing Vulnerability CVE-2024-434516.5NTLM Hash Disclosure Spoofing Vulnerability CVE-2024-434527.5Windows Registry Elevation of Privilege Vulnerability CVE-2024-434538.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability CVE-2024-434547.1Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability