PT-2017-14511 · Otrs+2 · Otrs+2

Publicado 2017-11-21 · Atualizado 2019-11-25 · CVE-2017-16664

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions 3.3 before 3.3.20 Open Ticket Request System (OTRS) versions 4 before 4.0.26 Open Ticket Request System (OTRS) versions 5 before 5.0.24

Description A code injection issue exists in the Kernel/System/Spelling.pm file. This allows an authenticated remote attacker to execute shell commands as the webserver user via URL manipulation in the agent interface.

Recommendations For versions 3.3 before 3.3.20, update to version 3.3.20 or later. For versions 4 before 4.0.26, update to version 4.0.26 or later. For versions 5 before 5.0.24, update to version 5.0.24 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

ALT-PU-2019-3068

ALT-PU-2019-3183

CVE-2017-16664

DLA-1212-1

DSA-4047-1

OPENSUSE-SU-2017_3054-1

Produtos afetados

Alt Linux

Otrs

Suse

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2017-16664 · Nota de Segurança
• https://debian.org/security/2017/dsa-4047 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16664 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16664 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-16664 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16664 · Aviso do Fabricante
• https://otrs.com/security-advisory-2017-07-security-update-otrs-framework · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16664 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4047-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-16664 · Nota de Segurança