CVE-2023-38057
Assigner: OTRS
Published: 2023-07-24T08:27:55.315Z
State: PUBLISHED
affected: defaultStatus: affected
packageName: Survey
product: OTRS
vendor: OTRS AG
versions: lessThan: 7.0.32
status: affected
version: 7.0.x
versionType: Patch
lessThan: 8.0.13
status: affected
version: 8.0.x
versionType: Patch
defaultStatus: affected
packageName: Survey
product: ((OTRS)) Community Edition
vendor: OTRS AG
versions: lessThanOrEqual: 6.0.22
status: affected
version: 6.0.x
versionType: All
configurations: supportingMedia: base64: no
type: text/html
value: Free text answers have to be used<br>
value: Free text answers have to be used

credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Special thanks to  Daniel Mizael, Raphael Fiorin and Marcelo Makotofrom for reporting these vulnerability.
datePublic: 2023-07-24T07:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent.<br><p>This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.</p>
value: An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent.
This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.


impacts: capecId: CAPEC-63
descriptions: value: CAPEC-63 Cross-Site Scripting (XSS)
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 
Update Survey package to version 8.0.13 or 7.0.32
<br>
value: Update Survey package to version 8.0.13 or 7.0.32


source: advisory: OSA-2023-06
defect: Issue#769
Ticket#2023020942001367
discovery: EXTERNAL
title: XSS stored in survey answers
x_generator: engine: Vulnogram 0.1.0-dev