VULNERABILITY INTELLIGENCE

CVE-2007-2524

CVSS score4.3 MEDIUM
EPSS probability4.54%
CISA KEVNot currently listed
Published2007-05-08
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references