1. Home
  2. CVE Database
  3. CVE-2022-0473
LOW · 3.8

CVE-2022-0473

OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exe...

Vulnerability Description

OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.

CVSS Score

3.8

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
OtrsOtrs>= 7.0.0, < 7.0.32

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2022-0473?

CVE-2022-0473 is a vulnerability with a CVSS score of 3.8 (LOW). OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exe...

How severe is CVE-2022-0473?

CVE-2022-0473 has been rated LOW with a CVSS base score of 3.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-0473?

Check the references section above for vendor advisories and patch information. Affected products include: Otrs Otrs.