PT-2013-1329 · Otrs+1 · Otrs Help Desk+1

Published 2013-06-25 · Updated 2024-06-15 · CVE-2013-4717

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) Help Desk versions 3.0.x through 3.0.21 Open Ticket Request System (OTRS) Help Desk versions 3.1.x through 3.1.17 Open Ticket Request System (OTRS) Help Desk versions 3.2.x through 3.2.8

Description The issue is related to multiple SQL injection vulnerabilities in the Open Ticket Request System (OTRS) Help Desk. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm. The exploitation of this vulnerability enables a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For Open Ticket Request System (OTRS) Help Desk versions 3.0.x through 3.0.21, update to version 3.0.22 or later. For Open Ticket Request System (OTRS) Help Desk versions 3.1.x through 3.1.17, update to version 3.1.18 or later. For Open Ticket Request System (OTRS) Help Desk versions 3.2.x through 3.2.8, update to version 3.2.9 or later. As a temporary workaround, consider restricting access to the vulnerable components, such as Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm, until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2014-1279

BDU:2022-01771

CVE-2013-4717

DSA-2733-1

MGASA-2013-0247

OPENSUSE-SU-2024:10073-1

Affected Products

Alt Linux

Otrs Help Desk

References · 47

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1695 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4717 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-4717 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4088 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4717 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1694 · Security Note
• https://osv.dev/vulnerability/CVE-2013-4717 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0247.html · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0247 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3551 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-4717 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10073-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4718 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4717 · Security Note
• https://bdu.fstec.ru/vul/2022-01771 · Security Note