PT-2017-14246 · Otrs+2 · Otrs+2

Published 2015-04-25 · Updated 2019-10-03 · CVE-2017-15864

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions 3.3.x through 3.3.18

Description The issue allows an attacker to gain sensitive information, such as database user and password, by using a crafted URL in the Agent Frontend of OTRS.

Recommendations For OTRS versions 3.3.x through 3.3.18, update to a version that contains a fix for this issue to prevent information disclosure.

Fix

Related Identifiers

ALT-PU-2015-1405

CVE-2017-15864

DLA-1212-1

DSA-4047-1

OPENSUSE-SU-2017_3054-1

Affected Products

Alt Linux

Otrs

Suse

References · 11

• https://osv.dev/vulnerability/CVE-2017-15864 · Vendor Advisory
• https://debian.org/security/2017/dsa-4047 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15864 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-15864 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-15864 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15864 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15864 · Vendor Advisory
• https://otrs.com/security-advisory-2017-06-security-update-otrs-3-3 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4047-1 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html · Note