CVE-2013-2637 - Vulnerability Details - OpenCVE

A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Opensuse	Opensuse
Otrs	Faq Otrs Itsm

Configuration 1 [-]

OR	cpe:2.3:a:otrs:faq::::::::
	cpe:2.3:a:otrs:faq::::::::
	cpe:2.3:a:otrs:otrs_itsm::::::::
	cpe:2.3:a:otrs:otrs_itsm::::::::
	cpe:2.3:a:otrs:otrs_itsm::::::::

Configuration 2 [-]

OR	cpe:2.3:o:opensuse:opensuse:12.2:::::::*
	cpe:2.3:o:opensuse:opensuse:12.3:::::::*

No data.

References

Link	Providers
http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html
http://www.exploit-db.com/exploits/24922
http://www.securityfocus.com/bid/58930
https://exchange.xforce.ibmcloud.com/vulnerabilities/83288

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-02-12T16:07:19

Updated: 2024-08-06T15:44:32.659Z

Reserved: 2013-03-22T00:00:00

Link: CVE-2013-2637

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-02-12T17:15:11.733

Modified: 2024-11-21T01:52:05.780

Link: CVE-2013-2637

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-04-02T00:00:00", "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-12T16:07:19", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html"}, {"tags": ["x_refsource_MISC"], "url": "http://www.securityfocus.com/bid/58930"}, {"tags": ["x_refsource_MISC"], "url": "http://www.exploit-db.com/exploits/24922"}, {"tags": ["x_refsource_MISC"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83288"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2013-2637", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html", "refsource": "MISC", "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html"}, {"name": "http://www.securityfocus.com/bid/58930", "refsource": "MISC", "url": "http://www.securityfocus.com/bid/58930"}, {"name": "http://www.exploit-db.com/exploits/24922", "refsource": "MISC", "url": "http://www.exploit-db.com/exploits/24922"}, {"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83288", "refsource": "MISC", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83288"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T15:44:32.659Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.securityfocus.com/bid/58930"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.exploit-db.com/exploits/24922"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83288"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-2637", "datePublished": "2020-02-12T16:07:19", "dateReserved": "2013-03-22T00:00:00", "dateUpdated": "2024-08-06T15:44:32.659Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:otrs:faq:*:*:*:*:*:*:*:*", "matchCriteriaId": "002EF3F8-1077-4C5D-A487-357AB6BFEB95", "versionEndExcluding": "2.0.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:otrs:faq:*:*:*:*:*:*:*:*", "matchCriteriaId": "A51091CA-6321-45F1-9FAA-EB45AF1949BA", "versionEndExcluding": "2.1.4", "versionStartIncluding": "2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:otrs:otrs_itsm:*:*:*:*:*:*:*:*", "matchCriteriaId": "76BF84E1-3633-4CFF-BB7B-4B126D1FD435", "versionEndExcluding": "3.0.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:otrs:otrs_itsm:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E23D8BE-818F-4F17-93C4-6E35840648AD", "versionEndExcluding": "3.1.8", "versionStartIncluding": "3.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:otrs:otrs_itsm:*:*:*:*:*:*:*:*", "matchCriteriaId": "6303666A-A55B-436F-8895-D0F63F387E50", "versionEndExcluding": "3.2.4", "versionStartIncluding": "3.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*", "matchCriteriaId": "D806A17E-B8F9-466D-807D-3F1E77603DC8", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*", "matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de tipo Cross-Site Scripting (XSS) en OTRS ITSM versiones anteriores a 3.2.4, 3.1.8 y 3.0.7 y FAQ versiones anteriores a 2.1.4 y 2.0.8, por medio de changes, workorder items, y FAQ articles, podr\u00edan permitir a un usuario malicioso remoto ejecutar c\u00f3digo arbitrario."}], "id": "CVE-2013-2637", "lastModified": "2024-11-21T01:52:05.780", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-12T17:15:11.733", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://www.exploit-db.com/exploits/24922"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/58930"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83288"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://www.exploit-db.com/exploits/24922"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/58930"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83288"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}