This vulnerability is a Cross-Site Scripting (CWE-79) issue in Znuny::ITSM 6.5.x, specifically in the customer.pl endpoint through the OTRSCustomerInterface parameter. The CVSS 3.1 score is 6.1 (medium), with an attack vector over the network, low attack complexity, no privileges required, user interaction required, and a scope change. The impact affects confidentiality and integrity at a low level, with no availability impact. There is no known exploit in the wild and no patch or vendor advisory information available at this time.

An attacker could exploit this XSS vulnerability to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or manipulation of data within the affected application session. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected endpoint and validating or sanitizing input parameters where possible as a temporary measure.