CVE-2017-16664: Code Injection
Published Nov 21, 2017
·Updated
Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.
Affected Software
7 affected componentsFixes available
debian/otrs2
6.0.16-26.0.16-2+deb10u16.0.32-6
OTRS OTRS>=3.3.0<3.3.20
OTRS OTRS>=4.0.0<4.0.26
OTRS OTRS>=5.0.0<5.0.24
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Event History
Nov 21, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-16664?
CVE-2017-16664 is considered a critical vulnerability due to the potential for remote code execution by an authenticated attacker.
2
How do I fix CVE-2017-16664?
To fix CVE-2017-16664, upgrade your OTRS installation to version 5.0.24, 4.0.26, or 3.3.20 or later.
3
Which versions of OTRS are affected by CVE-2017-16664?
CVE-2017-16664 affects OTRS versions before 5.0.24, 4.0.26, and 3.3.20.
4
Can an unauthenticated user exploit CVE-2017-16664?
No, an authenticated remote attacker is required to exploit CVE-2017-16664.
5
What components are affected by CVE-2017-16664?
The vulnerability is found in Kernel/System/Spelling.pm within the OTRS agent interface.