CVE-2017-9324
HighSummary
In Open Ticket Request System (OTRS) versions 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission can open a specific URL in a browser to gain administrative privileges and full access to the system.
Risk Assessment
This vulnerability may lead to unauthorized access to system settings, posing a risk to the confidentiality and integrity of data within the organization.
Recommendation
It is recommended to update OTRS to the latest version to mitigate this vulnerability and restrict access to installation functions to trusted users.
Other vulnerabilities in Open Ticket Request System (OTRS)
See all- CVE-2017-17476High
Open Ticket Request System (OTRS) versions 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, may allow remote attackers to hijack web sessions and gain privileges via a crafted email.
- CVE-2017-14635High
In Open Ticket Request System (OTRS) versions 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.
Original NVD description (English source)
In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.