CVE-2017-15864
high
CVSS v3
8.8
CVSS v2
4.0
VIR risk
8.8
Description
In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-15864
Vendor advisory: cve@mitre.org — https://www.otrs.com/security-advisory-2017-06-security-update-otrs-3-3/
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | 7.0 | affected | |
| debian | 8.0 | affected | |
| debian | 9.0 | affected | |
| debian | bullseye | fixed | 4.0.7-2 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| otrs | otrs | {"startIncluding":"3.3.0","endIncluding":"3.3.18"} | |
References
Verify integrity in audit chain (admin only). AS-IS.