CVE-2007-2524: otrs Cross-site Scripting

EPSS trend

Probability

4.54%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.54% on 18-09-2026

18-09-202618-10-2026

EPSS score

4.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (virtuax.be)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasecgiVerified
OTRS 2.0.4 - index.pl Cross-Site Scripting
Maturity: poc

References

15 links

www.vupen.com/english/advisories/2007/1698VDB EntryX Refsource VUPEN
www.virtuax.be?page=library&id=35&type=ExploitsX Refsource MISCExploitVendor Advisory
www.securityfocus.com/archive/1/471192/100/0/threadedMailing ListX Refsource BUGTRAQ
exchange.xforce.ibmcloud.com/vulnerabilities/34164VDB EntryX Refsource XF
www.securityfocus.com/bid/23862VDB EntryX Refsource BIDExploit
secunia.com/advisories/25205Third Party AdvisoryX Refsource SECUNIAVendor Advisory
osvdb.org/35822VDB EntryX Refsource OSVDB
www.debian.org/security/2007/dsa-1298Vendor AdvisoryX Refsource DEBIAN
securityreason.com/securityalert/2668Third Party AdvisoryX Refsource SREASON
www.novell.com/linux/security/advisories/2007_13_sr.htmlVendor AdvisoryX Refsource SUSE

Show all 15 references

www.securityfocus.com/archive/1/467870/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/25787Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/25419Third Party AdvisoryX Refsource SECUNIAVendor Advisory
osvdb.org/35821VDB EntryX Refsource OSVDB
security-tracker.debian.org/tracker/CVE-2007-2524Advisory

Related vulnerabilities

CVE-2018-11563debianotrs2+30.82%7y ago08-07-2019 12:23An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application.CVE-2018-20800debianotrs2+20.99%7y ago13-03-2019 22:00An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13. Users updating to 6.0.13 (also patchlevel updates) or 5.0.31 (only major updates) will experience data loss in their agent preferences table.CVE-2018-17883debianotrs2+20.44%3y ago15-04-2023 00:00An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS.CVE-2018-7567debianotrs2+25.20%8y ago04-03-2018 20:00In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary.CVE-2018-10198debianotrs2+20.95%8y ago06-06-2018 20:00An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets.CVE-2013-4718otrsotrs+10.67%5y ago09-08-2021 18:03Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search.

All vulnerabilities inotrs

CVE-2007-2524: otrs Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References