CVE-2022-0473

OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.

• CWE-79
• CWE-79

• https://otrs.com/release-notes/otrs-security-advisory-2022-01/Vendor Advisory
• https://otrs.com/release-notes/otrs-security-advisory-2022-01/Vendor Advisory

Published

Feb 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0467Inappropriate implementation in Pointer Lock in Google Chrom…8.8
• CVE-2022-0468Use after free in Payments in Google Chrome prior to 98.0.47…8.8
• CVE-2022-0469Use after free in Cast in Google Chrome prior to 98.0.4758.8…8.8
• CVE-2022-0470Out of bounds memory access in V8 in Google Chrome prior to …8.8
• CVE-2022-0471The Favicon by RealFaviconGenerator WordPress plugin before …6.1
• CVE-2022-0472Unrestricted Upload of File with Dangerous Type in Packagist…5.4
• CVE-2022-0474Full list of recipients from customer users in a contact fie…3.5
• CVE-2022-0475Malicious translator is able to inject JavaScript code in fe…5.4
• CVE-2022-0476Denial of Service in GitHub repository radareorg/radare2 pri…5.5
• CVE-2022-0477An issue has been discovered in GitLab affecting all version…4.9
• CVE-2022-0478The Event Manager and Tickets Selling for WooCommerce WordPr…8.8
• CVE-2022-0479The Popup Builder WordPress plugin before 4.1.1 does not san…9.8