UBUNTU-CVE-2023-38057
- Source
- https://ubuntu.com/security/CVE-2023-38057
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-38057.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-38057
- Upstream
- Published
- 2023-07-24T09:15:00Z
- Modified
- 2025-07-14T06:46:24.404790Z
- Severity
-
- 4.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- - medium
- Summary
- [none]
- Details
-
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
- References
Affected packages
Ubuntu:Pro:16.04:LTS / otrs2
Package
- Name
- otrs2
- Purl
- pkg:deb/ubuntu/otrs2@5.0.7-1?arch=source&distro=esm-apps/xenial
Ubuntu:Pro:18.04:LTS / otrs2
Package
- Name
- otrs2
- Purl
- pkg:deb/ubuntu/otrs2@6.0.5-1?arch=source&distro=esm-apps/bionic
Ubuntu:Pro:20.04:LTS / otrs2
Package
- Name
- otrs2
- Purl
- pkg:deb/ubuntu/otrs2@6.0.26-1?arch=source&distro=esm-apps/focal
Ubuntu:22.04:LTS / otrs2
Package
- Name
- otrs2
- Purl
- pkg:deb/ubuntu/otrs2@6.2.2-2?arch=source&distro=jammy
Ubuntu:24.04:LTS / znuny
Package
- Name
- znuny
- Purl
- pkg:deb/ubuntu/znuny@6.5.6-1?arch=source&distro=noble