title: XSS stored in survey answers
description: An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent.
This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: affected
packageName: Survey
product: OTRS
vendor: OTRS AG
versions:
lessThan: 7.0.32, status: affected, version: 7.0.x, versionType: Patch
lessThan: 8.0.13, status: affected, version: 8.0.x, versionType: Patch
}
{
defaultStatus: affected
packageName: Survey
product: ((OTRS)) Community Edition
vendor: OTRS AG
versions:
lessThanOrEqual: 6.0.22, status: affected, version: 6.0.x, versionType: All
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Survey package to version 8.0.13 or 7.0.32