A vulnerability has been reported in OTRS Help Desk and OTRS ITSM, which can be exploited by malicious people to conduct script insertion attacks.

Input passed within HTML e-mail messages is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires that the victim user is running a browser which executes certain JavaScript statements from CSS (e.g. Internet Explorer).

The vulnerability is reported in OTRS Help Desk versions prior to 2.4.13, 3.0.15, and 3.1.9 and in OTRS ITSM versions prior to 2.1.5, 3.0.6, and 3.1.5.

Solution
Update to a fixed version.
Further details available to Secunia VIM customers

Provided and/or discovered by
loneferret, Offensive Security

Changelog
Further details available to Secunia VIM customers

Original Advisory
OTRS:
http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01/

loneferret:
http://www.exploit-db.com/exploits/20359/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers