CVE-2017-17476
HighSummary
Open Ticket Request System (OTRS) versions 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, may allow remote attackers to hijack web sessions and gain privileges via a crafted email.
Risk Assessment
Session hijacking could lead to unauthorized access to the system, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update OTRS to the latest version and enable cookie support to minimize the risk of session hijacking.
Other vulnerabilities in Open Ticket Request System (OTRS)
See all- CVE-2017-14635High
In Open Ticket Request System (OTRS) versions 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.
- CVE-2017-9324High
In Open Ticket Request System (OTRS) versions 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission can open a specific URL in a browser to gain administrative privileges and full access to the system.
Original NVD description (English source)
Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.