CVE-2019-9752: Opensuse Backports Sle

Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.

Affected products

• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only; version 15.2 only
• Otrs Otrs: from 5.0.0, before 5.0.34 (fixed in 5.0.34); from 6.0.0, before 6.0.16 (fixed in 6.0.16); from 7.0.0, before 7.0.4 (fixed in 7.0.4)

Published 2019-03-13. Last modified 2026-06-17.