CVE-2017-17476

Published: Dec 20, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.

Affected (6)

Products: Otrs: Otrs · Debian: Debian Linux

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Otrs Otrs	From 4.0.0 to 4.0.28
Otrs Otrs	From 5.0.0 to 5.0.26
Otrs Otrs	From 6.0.0 to 6.0.3

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2017/12/msg00018.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.debian.org/security/2017/dsa-4069

Source: cve@mitre.org

Third Party Advisory

https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb