CVE-2017-9324: High severity OTRS OTRS vulnerability
In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9324?
CVE-2017-9324 is considered a critical vulnerability due to the potential for unauthorized administrative access.
How do I fix CVE-2017-9324?
To fix CVE-2017-9324, upgrade OTRS to a version that is not affected, specifically versions 3.3.17, 4.0.24, or 5.0.20 and above.
Who is affected by CVE-2017-9324?
CVE-2017-9324 affects users of Open Ticket Request System (OTRS) versions 3.3.x to 3.3.16, 4.x to 4.0.23, and 5.x to 5.0.19.
What versions of OTRS are vulnerable to CVE-2017-9324?
Versions of OTRS vulnerable to CVE-2017-9324 include any from 3.3.0 through 3.3.16, 4.0.0 through 4.0.23, and 5.0.0 through 5.0.19.
What impact does CVE-2017-9324 have on system security?
CVE-2017-9324 allows an attacker with agent permissions to gain full administrative access, compromising the system's integrity and confidentiality.