Admin-to-admin stored XSS via configuration input

Stored XSS in OTRS and OTRS Community Edition allows remote authenticated users with admin rights to target other administrators. The System Configuration modules insufficiently filter attacker-controlled configuration input before storing and rendering it in an administrative view; the precise field and code path are undisclosed. Exploitation requires an administrator to submit the payload, and execution in another administrator's session permits unauthorized page-content modification.