CVE-2005-3895: Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the…

Unscored severity · published Nov 29, 2005

CVE-2005-3895

Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the…

–

CVSS

2.1%

EPSS

On KEV

Description

Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML. NOTE: this particular issue is referred to as XSS by some sources.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.1% · higher than 81% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Otrs · Otrs

1.0.0; 1.3.2; 2.0.0; 2.0.1; 2.0.2; 2.0.3 · source: NVD

Affected product

Otrs