CVE-2017-15864: High severity otrs vulnerability
Published Nov 16, 2017
·Updated
In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password.
Affected Software
5 affected componentsFixes available
debian/otrs2
6.0.16-26.0.16-2+deb10u16.0.32-6
OTRS OTRS>=3.3.0<=3.3.18
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Event History
Nov 16, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-15864?
CVE-2017-15864 is classified as a medium-severity vulnerability due to the potential exposure of sensitive database information.
2
How do I fix CVE-2017-15864?
To fix CVE-2017-15864, users should upgrade to OTRS version 6.0.16-2 or later.
3
What kind of information can be leaked due to CVE-2017-15864?
CVE-2017-15864 can leak sensitive information such as database usernames and passwords through crafted URLs.
4
Which versions of OTRS are affected by CVE-2017-15864?
CVE-2017-15864 affects OTRS versions from 3.3.x up to and including 3.3.18.
5
Is CVE-2017-15864 applicable to all Debian versions?
CVE-2017-15864 is specifically applicable to Debian versions 7.0, 8.0, and 9.0 when running the affected versions of OTRS.