CVE-2017-9324
First published: Mon Jun 12 2017(Updated: )
In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OTRS | >=3.3.0<=3.3.16 | |
| OTRS | >=4.0.0<=4.0.23 | |
| OTRS | >=5.0.0<=5.0.19 | |
| Debian GNU/Linux | =8.0 | |
| Debian GNU/Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-9324?
CVE-2017-9324 is considered a critical vulnerability due to the potential for unauthorized administrative access.
How do I fix CVE-2017-9324?
To fix CVE-2017-9324, upgrade OTRS to a version that is not affected, specifically versions 3.3.17, 4.0.24, or 5.0.20 and above.
Who is affected by CVE-2017-9324?
CVE-2017-9324 affects users of Open Ticket Request System (OTRS) versions 3.3.x to 3.3.16, 4.x to 4.0.23, and 5.x to 5.0.19.
What versions of OTRS are vulnerable to CVE-2017-9324?
Versions of OTRS vulnerable to CVE-2017-9324 include any from 3.3.0 through 3.3.16, 4.0.0 through 4.0.23, and 5.0.0 through 5.0.19.
What impact does CVE-2017-9324 have on system security?
CVE-2017-9324 allows an attacker with agent permissions to gain full administrative access, compromising the system's integrity and confidentiality.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/description
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/otrs
- canonical/otrs
- version/otrs/3.3.0
- version/otrs/3.3.16
- version/otrs/4.0.0
- version/otrs/4.0.23
- version/otrs/5.0.0
- version/otrs/5.0.19
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/8.0
- version/debian gnu/linux/9.0