CVE-2007-2524 Information

Description

Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue but the proper identifier for the ipsec-tools issue is CVE-2007-1841.

Reference

http://osvdb.org/35821 http://osvdb.org/35822 http://secunia.com/advisories/25205 http://secunia.com/advisories/25419 http://secunia.com/advisories/25787 http://securityreason.com/securityalert/2668 http://www.debian.org/security/2007/dsa-1298 http://www.novell.com/linux/security/advisories/2007_13_sr.html http://www.securityfocus.com/archive/1/467870/100/0/threaded http://www.securityfocus.com/archive/1/471192/100/0/threaded http://www.securityfocus.com/bid/23862 http://www.virtuax.be/?page=library&id=35&type=Exploits http://www.vupen.com/english/advisories/2007/1698 https://exchange.xforce.ibmcloud.com/vulnerabilities/34164