CVE-2017-16921
High · 8.8CVSS
8.8
EPSS
19.9%
Published
Dec 8, 2017
CISA due date
—
The record
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | otrs2 | 0 | 6.0.2-1 |
| Debian:7 | otrs2 | 0 | 3.3.18-1~deb7u2 |
| Debian:8 | otrs2 | 0 | 3.3.18-1+deb8u3 |
| Debian:9 | otrs2 | 0 | 5.0.16-1+deb9u4 |
| Ubuntu:16.04:LTS | otrs2 | 0 | No fix |
| Ubuntu:18.04:LTS | otrs2 | 0 | 6.0.5-1 |
| Ubuntu:Pro:16.04:LTS | otrs2 | 0 | No fix |
Related vulnerabilities
- CVE-2023-38060 Improper Input Validation vulnerability in the ContentType parameter for attachments on… Also affects otrs2
- CVE-2021-41184 jQuery-UI is the official jQuery user interface library. Also affects otrs2
- CVE-2021-41182 jQuery-UI is the official jQuery user interface library. Also affects otrs2
- CVE-2021-41183 jQuery-UI is the official jQuery user interface library. Also affects otrs2
- CVE-2020-11022 In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources… Also affects otrs2
- CVE-2008-7220 Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2… Also affects otrs2
- CVE-2024-23790 Improper Input Validation vulnerability in the upload functionality for user avatars… Also affects otrs2
- CVE-2024-23791 Insertion of debug information into log file during building the elastic search index… Also affects otrs2