PT-2017-18831 · Otrs · Open Ticket Request System

Code16 · Publicado 2017-05-29 · Atualizado 2017-11-24 · CVE-2017-9299

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions prior to 3.3.20

Description The issue concerns a Cross-Site Scripting (XSS) attack. Specifically, it affects index.pl requests with the Action=AgentStats parameter. The vulnerability can be exploited through the OrderBy and Direction parameters, allowing for XSS attacks, as demonstrated by OrderBy=[XSS] and Direction=[XSS].

Recommendations For versions prior to 3.3.20, update to version 3.3.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the index.pl endpoint with the Action=AgentStats parameter to minimize the risk of exploitation. Avoid using the OrderBy and Direction parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-9299

Produtos afetados

Open Ticket Request System

Referências · 6

• 🔥 http://code610.blogspot.com/2017/05/turnkey-feat-otrs.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-9299 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-9299 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-9299 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-9299 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9299 · Aviso do Fabricante