UBUNTU-CVE-2023-38057

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2023-38057

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-38057.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-38057

Related

CVE-2023-38057

Published

2023-07-24T09:15:00Z

Modified

2025-06-03T17:46:40Z

Severity

4.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.

References

Affected packages

Ubuntu:Pro:16.04:LTS / otrs2

Package

Name: otrs2
Purl: pkg:deb/ubuntu/otrs2@5.0.7-1?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.10-1

5.*

5.0.1-1

5.0.1-2

5.0.2-1

5.0.3-1

5.0.5-1

5.0.6-1

5.0.7-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / otrs2

Package

Name: otrs2
Purl: pkg:deb/ubuntu/otrs2@6.0.5-1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.0.23-1

5.0.24-1

6.*

6.0.1-1

6.0.2-1

6.0.3-1

6.0.4-1

6.0.5-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:20.04:LTS / otrs2

Package

Name: otrs2
Purl: pkg:deb/ubuntu/otrs2@6.0.26-1?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.0.20-1

6.0.23-2

6.0.24-1

6.0.25-1

6.0.25-2

6.0.25-3

6.0.26-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / otrs2

Package

Name: otrs2
Purl: pkg:deb/ubuntu/otrs2@6.2.2-2?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.0.32-6

6.1.2-1

6.2.1-1

6.2.2-2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / znuny

Package

Name: znuny
Purl: pkg:deb/ubuntu/znuny@6.5.10-1?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.5.6-1

6.5.8-1

6.5.9-1

6.5.10-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / znuny

Package

Name: znuny
Purl: pkg:deb/ubuntu/znuny@6.5.6-1?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.5.3-1

6.5.4-1

6.5.5-1

6.5.6-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:25.04 / znuny

Package

Name: znuny
Purl: pkg:deb/ubuntu/znuny@6.5.14-1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.5.10-1

6.5.11-1

6.5.13-1

6.5.13-1build1

6.5.14-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}