ID de Prueba:	1.3.6.1.4.1.25623.1.0.103933
Categoría:	Web application abuses
Título:	OTRS Help Desk Cross Site Scripting/Clickjacking Vulnerability
Resumen:	OTRS Help Desk is prone to a cross site scripting and to a clickjacking; vulnerability because it fails to properly sanitize user-supplied input before using; it in dynamically generated content.
Descripción:	Summary: OTRS Help Desk is prone to a cross site scripting and to a clickjacking vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Vulnerability Insight: Two vulnerabilities have been reported in OTRS Help Desk, which can be exploited by malicious people to conduct cross-site scripting and clickjacking attacks. 1) Certain input related to dynamic fields is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) The application allows users to perform certain actions via HTTP requests via iframes without performing any validity checks to verify the requests. This can be exploited to perform certain unspecified actions by tricking a user into e.g. clicking a specially crafted link via clickjacking. Vulnerability Impact: An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Affected Software/OS: Versions OTRS Help Desk prior to 3.1.21, 3.2.16 and 3.3.6 are vulnerable. Solution: Upgrade to Open Ticket Request System (OTRS) 3.1.21, 3.2.16 or 3.3.6 CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2553 http://secunia.com/advisories/57616 SuSE Security Announcement: openSUSE-SU-2014:0561 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html Common Vulnerability Exposure (CVE) ID: CVE-2014-2554
Copyright	Copyright (C) 2014 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.