CVE-2017-17476

moderate-risk
Published 2017-12-20

Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.

Do I need to act?

-
0.91% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Otrs Debian

References (12)

Patch https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb
Patch https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc
Patch https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953
Mailing List https://lists.debian.org/debian-lts-announce/2017/12/msg00018.html
Third Party Advisory https://www.debian.org/security/2017/dsa-4069
Patch https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/
Patch https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb
Patch https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc
Patch https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953
Mailing List https://lists.debian.org/debian-lts-announce/2017/12/msg00018.html
Third Party Advisory https://www.debian.org/security/2017/dsa-4069
Patch https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/
43
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 3/34 · Minimal
Exposure 10/34 · Low