title:  Possible XSS execution in customer information
description: An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs
immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.
This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: affected
modules: Agent Interface
product: OTRS
vendor: OTRS AG
versions:
lessThan: 7.0.47, status: affected, version: 7.0.x, versionType: Patch
lessThan: 8.0.37, status: affected, version: 8.0.x, versionType: Patch
}
{
defaultStatus: affected
modules: Agent Interface
product: ((OTRS)) Community Edition
vendor: OTRS AG
versions:
lessThanOrEqual: 6.0.34, status: affected, version: 6.0.x, versionType: All
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update to OTRS 7.0.47 or OTRS 8.0.37.
workarounds: Switch AdminCustomerUser::UseAutoComplete off