{"id":"CVE-2016-9139","details":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.","modified":"2026-03-12T22:29:55.401893Z","published":"2017-02-17T02:59:13.843Z","related":["openSUSE-SU-2024:10073-1"],"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/94141"},{"type":"ADVISORY","url":"https://www.otrs.com/security-advisory-2016-02-security-update-otrs/"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9139.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"3.0.0-beta1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.0-beta2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.0-beta3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.0-beta4"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.0-beta5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.0-beta6"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.0-beta7"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.4"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.6"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.7"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.8"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.9"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.10"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.11"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.12"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.13"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.14"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.15"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.16"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.17"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.0"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.4"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.6"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.7"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.8"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.9"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.10"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.11"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.13"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.14"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.15"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.16"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.17"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.18"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.19"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.20"}]},{"events":[{"introduced":"0"},{"last_affected":"3.1.21"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.0"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.0-beta1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.0-beta2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.0-beta3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.0-beta4"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.0-beta5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.0-rc1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.4"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.6"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.7"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.8"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.9"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.10"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.11"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.12"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.13"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.14"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.15"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2.16"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.0"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.0-beta1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.0-beta2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.0-beta3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.0-beta4"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.0-beta5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.0-rc1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.4"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.6"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.7"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.8"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.9"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.10"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.11"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.12"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.13"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.14"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3.15"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.0-beta1"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.0-beta2"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.0-beta3"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.0-beta4"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.0-beta5"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.0-rc1"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.2"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.4"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.5"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.6"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.7"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.8"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.9"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.10"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.11"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.12"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.13"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.14"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.15"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.16"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.17"}]},{"events":[{"introduced":"0"},{"last_affected":"4.0.18"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.0-beta1"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.0-beta2"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.0-beta3"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.0-beta4"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.0-beta5"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.0-rc1"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.2"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.4"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.5"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.6"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.7"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.8"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.9"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.10"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.11"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.12"}]},{"events":[{"introduced":"0"},{"last_affected":"5.0.13"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}