PT-2013-1329 · Otrs+1 · Otrs Help Desk+1

Publicado 2013-06-25 · Atualizado 2024-06-15 · CVE-2013-4717

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) Help Desk versions 3.0.x through 3.0.21 Open Ticket Request System (OTRS) Help Desk versions 3.1.x through 3.1.17 Open Ticket Request System (OTRS) Help Desk versions 3.2.x through 3.2.8

Description The issue is related to multiple SQL injection vulnerabilities in the Open Ticket Request System (OTRS) Help Desk. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm. The exploitation of this vulnerability enables a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For Open Ticket Request System (OTRS) Help Desk versions 3.0.x through 3.0.21, update to version 3.0.22 or later. For Open Ticket Request System (OTRS) Help Desk versions 3.1.x through 3.1.17, update to version 3.1.18 or later. For Open Ticket Request System (OTRS) Help Desk versions 3.2.x through 3.2.8, update to version 3.2.9 or later. As a temporary workaround, consider restricting access to the vulnerable components, such as Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm, until a patch is available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

ALT-PU-2014-1279

BDU:2022-01771

CVE-2013-4717

DSA-2733-1

MGASA-2013-0247

OPENSUSE-SU-2024:10073-1

Produtos afetados

Alt Linux

Otrs Help Desk

Referências · 47

• https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7 · Nota
• https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312 · Nota
• https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1695 · Nota de Segurança
• http://packetstormsecurity.com/files/131654/OTRS-3.x-Cross-Site-Scripting.html · Nota
• https://suse.com/security/cve/CVE-2013-4717 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4717 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-2553 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-4717 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-9324 · Nota
• https://suse.com/security/cve/CVE-2013-3551 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4088 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4717 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=10927 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4717 · Nota