CVE-2010-2080
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x...
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2010-2080- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2010-2080- Updated
- 2026-11-02
EUVDEUVD-2010-2098No score
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Record
EUVD-2010-2098- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2j92-9gm3-m87qNo score
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x...
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Record
GHSA-2j92-9gm3-m87q- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2010-2080- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2080No score
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Record
DEBIAN-CVE-2010-2080- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 | before 2.4.8+dfsg1-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 | 2.4.8+dfsg1-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2080 is a low vulnerability (CVSS 3.5) in Otrs, published September 20, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in otrs2 2.4.8+dfsg1-1.
References
security-tracker.debian.org/tracker/CVE-2010-2080
secunia.com/advisories/41381
otrs.org/advisory/OSA-2010-02-en
exchange.xforce.ibmcloud.com/vulnerabilities/61868
lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
securityfocus.com/bid/43264
nvd.nist.gov/vuln/detail/CVE-2010-2080
github.com/advisories/GHSA-2j92-9gm3-m87q
Left out here: 15 versions. The JSON record has them.