CVE-2020-1766: debian debian_linux Cross-site Scripting
Vulnerability summary
CVE-2020-1766 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 10-01-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA2.0LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.23%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
0.00 pp
From 1.23% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- otrs2< 6.0.25-1
- debian_linuxEOL8.0
Otrs ag2 products
- otrs7.0.x version 7.0.13 and prior versions
- ((otrs)) community edition5.0.x version 5.0.39 and prior versions | 6.0.x version 6.0.24 and prior versions
Otrs1 product
- otrs≥ 5.0.0, ≤ 5.0.39 | ≥ 6.0.0, ≤ 6.0.24 | ≥ 7.0.0, ≤ 7.0.13
Ubuntu1 product
- otrs2All versions (No fix recorded)
4 vendors · 6 products
References
9 links
lists.debian.org/debian-lts-announce/2020/01/msg00027.htmlMailing ListNot ApplicableThird Party Advisory