CVE-2023-38057
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent.
Risk Assessment
The organization may be exposed to XSS attacks, which can lead to credential theft or session hijacking. Specifically, an attacker could exploit this vulnerability to manipulate data within the system.
Recommendation
It is recommended to update the OTRS Survey module to version 7.0.32 or 8.0.13 to mitigate this vulnerability. A security audit of the application should also be conducted to identify other potential vulnerabilities.
Original NVD description (English source)
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.