ZSA-2019-02
Privilege escalation using a manipulated URL to execute JavaScript code
Problem
An attacker who is logged into OTRS as an admin can execute JavaScript by manipulating the URL.
Workaround
As a workaround, you can replace the affected files.
Solution
Upgrade to the latest available OTRS patch level (https://ftp.otrs.org/pub/otrs/).