CVE-2013-4717: SQL Injection
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2013-4717?
CVE-2013-4717 is a vulnerability in the Open Ticket Request System (OTRS) Help Desk software that allows remote authenticated users to execute arbitrary SQL commands.
How severe is CVE-2013-4717?
CVE-2013-4717 has a severity rating of 8.8 (high).
Which versions of OTRS are affected by CVE-2013-4717?
CVE-2013-4717 affects OTRS Help Desk versions 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9.
How do I fix CVE-2013-4717?
To fix CVE-2013-4717, you should upgrade your OTRS Help Desk software to version 3.0.22, 3.1.18, or 3.2.9.
Where can I find more information about CVE-2013-4717?
You can find more information about CVE-2013-4717 at the following link: [https://web.archive.org/web/20130817120539/http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2013-05/](https://web.archive.org/web/20130817120539/http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2013-05/)