CVE-2013-2637

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-12 · updated 2026-06-16
Weakness: CWE-79

Description

A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.

Affected products

Opensuse: 12.2, 12.3
OTRS AG FAQ: before 2.0.8; from 2.1.0 before 2.1.4 — fixed in 2.0.8, 2.1.4
Otrs Itsm: before 3.0.7; from 3.1.0 before 3.1.8; from 3.2.0 before 3.2.4 — fixed in 3.0.7, 3.1.8, 3.2.4

How to fix

Upgrade to a fixed version: OTRS AG FAQ 2.0.8, 2.1.4; Otrs Itsm 3.0.7, 3.1.8, 3.2.4. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html
http://www.exploit-db.com/exploits/24922
http://www.securityfocus.com/bid/58930
https://exchange.xforce.ibmcloud.com/vulnerabilities/83288
http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html
http://www.exploit-db.com/exploits/24922
http://www.securityfocus.com/bid/58930
https://exchange.xforce.ibmcloud.com/vulnerabilities/83288

Get alerted when CVE-2013-2637 or the next vulnerability affects your stack