{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-17T16:47:38.625","vulnerabilities":[{"cve":{"id":"CVE-2020-1771","sourceIdentifier":"security@otrs.com","published":"2020-03-27T13:15:15.333","lastModified":"2024-11-21T05:11:21.357","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions."},{"lang":"es","value":"Un atacante es capaz de diseñar un artículo con un enlace hacia la libreta de direcciones del cliente con contenido malicioso (JavaScript). Cuando el agente abre el enlace, el código JavaScript es ejecutado debido a la falta de codificación de parámetros. Este problema afecta a: ((OTRS)) Community Edition: versiones 6.0.26 y anteriores. OTRS: versiones 7.0.15 y anteriores."}],"metrics":{"cvssMetricV31":[{"source":"security@otrs.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@otrs.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"5.0.41","matchCriteriaId":"D59B7180-350C-4CB2-82F6-DE65E13AEED9"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*","versionStartIncluding":"6.0.0","versionEndIncluding":"6.0.26","matchCriteriaId":"0EF80E5E-ED59-4BEE-9EBF-34485DCABED1"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndIncluding":"7.0.15","matchCriteriaId":"57789F0A-B1F9-4E57-BA71-5558A285D1CA"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html","source":"security@otrs.com","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html","source":"security@otrs.com","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html","source":"security@otrs.com","tags":["Broken Link"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","source":"security@otrs.com"},{"url":"https://otrs.com/release-notes/otrs-security-advisory-2020-08/","source":"security@otrs.com","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://otrs.com/release-notes/otrs-security-advisory-2020-08/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}