CVE-2022-0475: XSS in OTRS ≤8.0.19

The primary impact of CVE-2022-0475 is the potential for arbitrary JavaScript execution within the OTRS Package manager. A successful exploit could allow an attacker to steal sensitive data, modify system configurations, or even gain control of the OTRS instance. Given that OTRS is often used for customer service and support, this could expose customer data, internal communications, and other confidential information. The ability to execute code within the Package manager significantly expands the attack surface, potentially allowing for persistent backdoors or further exploitation of the system. While the CVSS score is LOW, the potential for data compromise and system manipulation warrants immediate attention.

1. Reserved2022-02-02
2. Published2022-03-21
3. Modified2024-09-17
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-0475 is to upgrade to a patched version of OTRS. OTRS AG has released updates to address this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Review and restrict the ability for translators to inject HTML into translatable strings. Implement strict input validation and output encoding to sanitize user-supplied data. Consider using a Web Application Firewall (WAF) to filter out malicious JavaScript payloads. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a translatable string and verifying that it is not executed.