Dynamic field error message is vulnerable to XSS

Successful exploitation of CVE-2022-0473 could allow an attacker to execute arbitrary JavaScript code in the context of an OTRS administrator's browser. This could lead to session hijacking, credential theft, or defacement of the OTRS interface. The attacker could potentially gain access to sensitive data stored within OTRS, including customer information, support tickets, and internal communications. While the CVSS score is LOW, the potential for administrator account compromise makes this a significant risk, particularly in environments where OTRS is used to manage critical business processes.

Organizations using OTRS for customer support or IT service management are at risk, particularly those relying on OTRS administrators with broad privileges. Environments with custom dynamic field configurations or legacy OTRS installations are especially vulnerable.

• otrs: Examine OTRS dynamic field configurations for suspicious regular expressions or unusual characters.

# Example: Search for potentially malicious code in dynamic field definitions
grep -r 'alert\(' /opt/otrs/ -print0 | xargs -0 grep -i 'script'

• generic web: Monitor OTRS access logs for unusual requests containing JavaScript code in dynamic field parameters.

# Example: Search for JavaScript code in OTRS access logs
grep -i 'alert(' /var/log/apache2/access.log

1. 2022-02-07Disclosure

   disclosure

1. Reservado2022-02-02
2. Publicada2022-02-07
3. Modificada2024-09-16
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2022-0473 is to upgrade to a patched version of OTRS. Consult the official OTRS advisory for the specific version containing the fix. As a temporary workaround, administrators should carefully review and validate all dynamic field configurations, paying close attention to regular expression checks. Implement strict input validation and sanitization on all user-supplied data used in dynamic fields. Consider using a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads.