CVE-2024-43443

What it actually does

Stored cross-site scripting flaw in Process Management modules allows an authenticated administrator to inject script payloads that execute in the browsers of other administrators viewing the same process definitions.

Why it matters to the business

An attacker who already holds administrative access can use the flaw to hijack sessions or actions of peer administrators, potentially expanding control over ticket workflows and customer data without needing additional privileges.

How an attack unfolds

An attacker with admin rights creates or edits a process definition in the Process Management interface, embedding a malicious script payload that is stored on the server and later rendered without sanitization when another administrator views or manages the process.

How to fix it

Upgrade OTRS to the latest patched release for the 7.0, 8.0, 2023, or 2024 series; upgrade ((OTRS)) Community Edition to a version beyond 6.0.x; or apply vendor-supplied input neutralization fixes in custom Process Management templates.

How to confirm the fix worked

Confirm the installed OTRS or Community Edition version is newer than the affected ranges listed; review Process Management templates for any remaining unsanitized input fields; retest by attempting to store and render a benign script payload as an admin user.

Typical attack path

1. Obtain administrative credentials through prior compromise or insider access
2. Navigate to the Process Management module and create or modify a process definition
3. Insert an unsanitized script payload into a field that is later displayed to other admins
4. Wait for or lure another administrator to view the affected process definition
5. Script executes in the victim administrator's browser, allowing session hijacking or further actions

How to detect it

Search administrative audit logs for unexpected modifications to process definitions; monitor web server access logs for unusual POST requests to Process Management endpoints containing script-like strings; inspect stored process templates for HTML or script tags.

What your security team should do

• Apply the vendor security update immediately for all affected OTRS and Community Edition instances
• Restrict administrative access to Process Management to the minimum necessary personnel
• Enable web application firewall rules that block common script patterns in administrative interfaces
• Review recent process definition changes in audit logs for unexpected content