CVEvulnerability
CVE-2017-17476
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-12-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-200
Description
Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.
Affected configurations
• otrs otrs (>= 4.0.0 < 4.0.28)
• otrs otrs (>= 5.0.0 < 5.0.26)
• otrs otrs (>= 6.0.0 < 6.0.3)
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb Patch, Third Party Advisory
- https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc Patch, Third Party Advisory
- https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00018.html Mailing List, Third Party Advisory
- https://www.debian.org/security/2017/dsa-4069 Third Party Advisory
- https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/ Patch, Vendor Advisory
- https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb Patch, Third Party Advisory
- https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc Patch, Third Party Advisory
- https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00018.html Mailing List, Third Party Advisory
- https://www.debian.org/security/2017/dsa-4069 Third Party Advisory
- https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/ Patch, Vendor Advisory