CVE-2010-4071
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when...
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.
- Record
CVE-2010-4071- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.
- Record
CVE-2010-4071- Updated
- 2026-11-02
EUVDEUVD-2010-4047 No score
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.
- Record
EUVD-2010-4047- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2fww-mhh6-5mxr No score
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when...
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.
- Record
GHSA-2fww-mhh6-5mxr- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.
- Record
CVE-2010-4071- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-4071 No score
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.
- Record
DEBIAN-CVE-2010-4071- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 |
before 2.4.9+dfsg1-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 |
2.4.9+dfsg1-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4071 is a low vulnerability (CVSS 2.6) in Otrs, published January 20, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. Fixed in otrs2 2.4.9+dfsg1-1.
References
osvdb.org/68882
secunia.com/advisories/41978
bugs.gentoo.org/342687
otrs.org/advisory/OSA-2010-03-en
lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
vuxml.org/freebsd/96e776c7-e75c-11df-8f26-00151735203a.html
nvd.nist.gov/vuln/detail/CVE-2010-4071
github.com/advisories/GHSA-2fww-mhh6-5mxr
security-tracker.debian.org/tracker/CVE-2010-4071
Left out here: 16 versions. The JSON record has them.