{"id":"CVE-2016-9139","aliases":["DEBIAN-CVE-2016-9139","DLA-787-1","EUVD-2016-9956","GHSA-fgw5-v59j-x5cw","UBUNTU-CVE-2016-9139","openSUSE-SU-2024:10073-1"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16...","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00816,"percentile":0.57357,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2017-01-16T00:00:00Z","modified":"2026-08-04T06:03:56Z","fixes":[{"ecosystem":"Debian:11","package":"otrs2","fixed_in":["5.0.14-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"otrs2","fixed_in":["3.1.7+dfsg1-8+deb7u6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.14-1"}]}],"versions":["2.0.4p01-10","2.0.4p01-11","2.0.4p01-12","2.0.4p01-13","2.0.4p01-14","2.0.4p01-14.1","2.0.4p01-15","2.0.4p01-16","2.0.4p01-17","2.0.4p01-18","2.0.4p01-6","2.0.4p01-7","2.0.4p01-8","2.0.4p01-9","2.0.99beta1-1","2.0.99beta1-2","2.1.1-1","2.1.3-1","2.1.4-1","2.1.4-2","2.1.5-1","2.1.5-2","2.1.5-3","2.1.6-1","2.1.7-1","2.1.7-2","2.2.0~beta2-1","2.2.0~beta3-1","2.2.1-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.5-2","2.2.6-1","2.2.7-1","2.2.7-2","2.2.7-2lenny1","2.2.7-2lenny2","2.2.7-2lenny3","2.2.7-3","2.3.2-1","2.3.2-2","2.3.3-1","2.3.4-1","2.3.4-2","2.3.4-3","2.3.4-4","2.3.4-5","2.3.4-6","2.3.4-7","2.4.10+dfsg1-1","2.4.10+dfsg1-2","2.4.10+dfsg1-3","2.4.5-1","2.4.5-2","2.4.5-3","2.4.5-4","2.4.5-5","2.4.6-1","2.4.6-2","2.4.7+dfsg1-1","2.4.7-1","2.4.7-2","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.8+dfsg1-1","2.4.9+dfsg1-1","2.4.9+dfsg1-2","2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4","2.4.9+dfsg1-3+squeeze5","2.4.9+dfsg1-4","2.4.9+dfsg1-5","3.0.10+dfsg1-1","3.0.10+dfsg1-2","3.0.11+dfsg1-1","3.0.8+dfsg1-1","3.0.9+dfsg1-1","3.1.0~beta4+dfsg1-1","3.1.0~beta5+dfsg1-1","3.1.0~rc1+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.2+dfsg1-1","3.1.2+dfsg1-2","3.1.2+dfsg1-3","3.1.3+dfsg1-1","3.1.3+dfsg1-2","3.1.4+dfsg1-1","3.1.5+dfsg1-1","3.1.5+dfsg1-2","3.1.5+dfsg1-3","3.1.6+dfsg1-1","3.1.7+dfsg1-1","3.1.7+dfsg1-2","3.1.7+dfsg1-3","3.1.7+dfsg1-4","3.1.7+dfsg1-5","3.1.7+dfsg1-6","3.1.7+dfsg1-7","3.1.7+dfsg1-8","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.10-1","3.3.11-1","3.3.18-1~deb7u1","3.3.18-1~deb7u2","3.3.18-1~deb7u3","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.7-2","3.3.8-1","3.3.9-1","3.3.9-2","3.3.9-3","3.3.9-3~bpo70+1","4.0.10-1","4.0.11-1","4.0.12-1","4.0.13-1","4.0.13-1~bpo8+1","4.0.5-1","4.0.5-2","4.0.6-1","4.0.7-1","4.0.7-2","4.0.8-1","4.0.9-1","5.0.1-1","5.0.1-2","5.0.10-1","5.0.10-1~bpo8+1","5.0.11-1","5.0.12-1","5.0.13-1","5.0.13-1~bpo8+1","5.0.13-2","5.0.14-1~bpo8+1","5.0.2-1","5.0.3-1","5.0.5-1","5.0.6-1","5.0.6-1~bpo8+1","5.0.7-1","5.0.8+dfsg1-1","5.0.8-1","5.0.8-1~bpo8+1","5.0.9+dfsg1-1","5.0.9+repack1-1"]},{"source":"osv","ecosystem":"Debian:7","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7+dfsg1-8+deb7u6"}]}],"versions":["3.1.7+dfsg1-8","3.1.7+dfsg1-8+deb7u1","3.1.7+dfsg1-8+deb7u2","3.1.7+dfsg1-8+deb7u3","3.1.7+dfsg1-8+deb7u4","3.1.7+dfsg1-8+deb7u5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.10-1","5.0.1-1","5.0.1-2","5.0.2-1","5.0.3-1","5.0.5-1","5.0.6-1","5.0.7-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.14-37.1"}]}],"bundled":14}],"products":[{"vendor":"otrs","product":"otrs"}],"references":[{"url":"http://www.securityfocus.com/bid/94141","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.otrs.com/security-advisory-2016-02-security-update-otrs/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9139"},{"url":"https://www.otrs.com/security-advisory-2016-02-security-update-otrs"},{"url":"https://github.com/advisories/GHSA-fgw5-v59j-x5cw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9139","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9139","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/11/01/5","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9139","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9139","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9139","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","status":"published","published":"2017-02-16T18:00:00Z","modified":"2024-08-06T02:42:10.57Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-9956","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","status":"published","published":"2017-02-16T18:00:00Z","modified":"2024-08-06T02:42:10Z","updated_at":"2026-11-03T02:22:28.196866Z"}],"ghsa":[{"id":"GHSA-fgw5-v59j-x5cw","title":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16...","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","status":"published","published":"2022-05-17T02:58:45Z","modified":"2025-04-20T03:32:59Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:40.176288Z"}],"nvd":[{"id":"CVE-2016-9139","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","status":"published","published":"2017-02-17T02:59:13.843Z","modified":"2026-06-17T00:55:35.073Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-9139","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","status":"published","published":"2017-02-17T02:59:13.843Z","modified":"2026-03-14T09:20:44.784329Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-9139","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","status":"published","published":"2017-02-17T02:59:13.843Z","modified":"2026-08-04T06:03:56.224823665Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9139","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","status":"published","published":"2017-02-17T02:59:00Z","modified":"2025-10-24T04:45:57Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-787-1","title":"otrs2 - security update","status":"published","published":"2017-01-16T00:00:00Z","modified":"2026-03-09T02:09:58.91123Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"openSUSE-SU-2024:10073-1","title":"otrs-3.3.16-37.1 on GA media","description":"These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:45.49578Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}