CVE-2017-14635
HighSummary
In Open Ticket Request System (OTRS) versions 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.
Risk Assessment
The organization may be exposed to unauthorized access to the system and the potential execution of malicious code, leading to serious security breaches.
Recommendation
It is recommended to update OTRS to the latest version to mitigate this vulnerability and to restrict user permissions to the minimum necessary.
Other vulnerabilities in Open Ticket Request System (OTRS)
See all- CVE-2017-17476High
Open Ticket Request System (OTRS) versions 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, may allow remote attackers to hijack web sessions and gain privileges via a crafted email.
- CVE-2017-9324High
In Open Ticket Request System (OTRS) versions 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission can open a specific URL in a browser to gain administrative privileges and full access to the system.
Original NVD description (English source)
In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.