{"id":"CVE-2013-2637","aliases":["EUVD-2013-2576","GHSA-6cx5-8j63-3v47","openSUSE-SU-2024:10073-1"],"status":"published","title":"A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7...","description":"A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04305,"percentile":0.91211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2020-02-12T16:07:19Z","modified":"2026-06-16T23:53:45Z","exploits":[{"source":"exploitdb","id":"EDB-24922","title":"OTRS 3.x - FAQ Module Persistent Cross-Site Scripting","type":"webapps","platform":"multiple","date":"2013-04-08","verified":true,"url":"https://www.exploit-db.com/exploits/24922"}],"affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.14-37.1"}]}],"bundled":14}],"products":[{"vendor":"opensuse","product":"opensuse"},{"vendor":"otrs","product":"faq"},{"vendor":"otrs","product":"otrs_itsm"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/58930","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/24922","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83288","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2637"},{"url":"https://github.com/advisories/GHSA-6cx5-8j63-3v47"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9139","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2637","description":"A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.","status":"published","published":"2020-02-12T16:07:19Z","modified":"2024-08-06T15:44:32.659Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2013-2576","description":"A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.","status":"published","published":"2020-02-12T16:07:19Z","modified":"2024-08-06T15:44:32Z","updated_at":"2026-11-03T01:56:38.194266Z"}],"ghsa":[{"id":"GHSA-6cx5-8j63-3v47","title":"A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7...","description":"A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.","status":"published","published":"2022-05-05T00:29:36Z","modified":"2023-02-01T05:01:50Z","updated_at":"2026-11-02T14:49:47.696223Z"}],"nvd":[{"id":"CVE-2013-2637","description":"A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.","status":"published","published":"2020-02-12T17:15:11.733Z","modified":"2026-06-16T23:53:45.147Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:52.934105Z"}],"osv":[{"id":"openSUSE-SU-2024:10073-1","title":"otrs-3.3.16-37.1 on GA media","description":"These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:45.49578Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}