CVE-2023-5421

What it actually does

Allows authenticated users with customer user management privileges to inject executable JavaScript into the CustomerID field; the payload runs immediately on save when AdminCustomerUser::UseAutoComplete is enabled.

Why it matters to the business

Privileged insiders or compromised accounts can execute scripts in other users' sessions, risking data leakage or unauthorized actions within the customer management interface; low exploit probability but still requires prompt patching given wide downstream use of the affected software.

How an attack unfolds

An attacker logs in with privileges to create or edit customer user data, alters the CustomerID field to contain a JavaScript payload, saves the record, and the script executes in the browser because the autocomplete configuration change bypasses normal escaping.

How to fix it

Upgrade OTRS to 7.0.47+, 8.0.37+ or Community Edition past 6.0.34; for themeum/tutor apply commit 532b3c416420c2d30be9c9757b8c001a8e3cb49e; disable or review AdminCustomerUser::UseAutoComplete if immediate upgrade is not feasible.

How to confirm the fix worked

Confirm installed version matches or exceeds the listed fixed releases, then attempt to store a benign script in CustomerID and verify it is no longer executed on save.

Typical attack path

1. Obtain valid credentials for a user with customer-user create/change rights
2. Access the AdminCustomerUser interface
3. Insert JavaScript payload into the CustomerID field
4. Save the record while UseAutoComplete is active
5. Script executes in victim browsers viewing the updated data

How to detect it

Search application and web-server logs for customer-user update events containing script tags or event handlers in the CustomerID field; review audit trails for recent changes made by accounts with customer-user privileges.

What your security team should do

• Apply the listed fixed versions or commit without delay
• Audit current AdminCustomerUser::UseAutoComplete setting and disable if unused
• Add monitoring for unexpected script tags in customer user records