CVE-2013-2637
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7...
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
- Record
CVE-2013-2637- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
- Record
CVE-2013-2637- Updated
- 2026-11-02
EUVDEUVD-2013-2576 No score
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
- Record
EUVD-2013-2576- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6cx5-8j63-3v47 No score
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7...
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
- Record
GHSA-6cx5-8j63-3v47- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10073-1 No score
otrs-3.3.16-37.1 on GA media
These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10073-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrsopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.3.14-37.1 | 3.3.14-37.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OTRS 3.x - FAQ Module Persistent Cross-Site Scripting | 2013-04-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2637 is a medium vulnerability (CVSS 6.1) in Otrs Faq, published February 12, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.30%, the 91st percentile. No source names a fixed version.
References
lists.opensuse.org/opensuse-updates/2013-08/msg00027.html
securityfocus.com/bid/58930
exploit-db.com/exploits/24922
exchange.xforce.ibmcloud.com/vulnerabilities/83288
nvd.nist.gov/vuln/detail/CVE-2013-2637
github.com/advisories/GHSA-6cx5-8j63-3v47
Show 14 moreShow less
suse.com/security/cve/CVE-2012-2582