PT-2017-14637 · Otrs+1 · Otrs+1

Bæln0Rn · Publicado 2017-12-08 · Atualizado 2021-04-22 · CVE-2017-16921

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OTRS versions 4.0.x through 4.0.26 OTRS versions 5.0.x through 5.0.24 OTRS versions 6.0.x through 6.0.1

Description The issue allows an attacker who is logged into OTRS as an agent to manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web server user.

Recommendations For OTRS versions 4.0.x through 4.0.26, update to a version that fixes the issue. For OTRS versions 5.0.x through 5.0.24, update to a version that fixes the issue. For OTRS versions 6.0.x through 6.0.1, update to a version that fixes the issue.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

ALT-PU-2019-3068

ALT-PU-2019-3183

CVE-2017-16921

DLA-1212-1

DSA-4066-1

Produtos afetados

Alt Linux

Otrs

Referências · 14

• 🔥 https://exploit-db.com/exploits/43853 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16921 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16921 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16921 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4066-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-16921 · Aviso do Fabricante
• http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html · Nota
• https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html · Nota
• https://bugs.otrs.org/show_bug.cgi?id=13357 · Nota
• https://cve.org/CVERecord?id=CVE-2017-16921 · Nota de Segurança
• https://otrs.com/security-advisory-2017-09-security-update-otrs-framework · Aviso do Fabricante
• https://debian.org/security/2017/dsa-4066 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16921 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16921 · Aviso do Fabricante