CVE-2018-14593
First published: Fri Aug 03 2018(Updated: )
An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/otrs2 | 6.0.16-2 6.0.16-2+deb10u1 6.0.32-6 | |
| OTRS | >=4.0.0<=4.0.30 | |
| OTRS | >=5.0.0<=5.0.28 | |
| OTRS | >=6.0.0<=6.0.9 | |
| Debian | =8.0 | |
| Debian | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://community.otrs.com/security-advisory-2018-03-security-update-for-otrs-framework/
- https://github.com/OTRS/otrs/commit/57cda14db8fdbcbfb8cabb32d85fbc89fde48c62
- https://github.com/OTRS/otrs/commit/7b6802723e1f5d1764b617e9fcf0a8dd21e96216
- https://github.com/OTRS/otrs/commit/78331ea187181d6130189d4563a50b4c30256320
- https://security-tracker.debian.org/tracker/CVE-2018-14593
- https://community.otrs.com/security-advisory-2018-03-security-update-for-otrs-framework/?lang=de
- https://lists.debian.org/debian-lts-announce/2018/08/msg00021.html
- https://www.debian.org/security/2018/dsa-4317
Frequently Asked Questions
What is the severity of CVE-2018-14593?
CVE-2018-14593 is considered a critical privilege escalation vulnerability.
How do I fix CVE-2018-14593?
To mitigate CVE-2018-14593, upgrade OTRS to version 6.0.16-2 or later.
Which versions of OTRS are affected by CVE-2018-14593?
CVE-2018-14593 affects OTRS versions from 4.0.x up to 4.0.30, 5.0.x up to 5.0.28, and 6.0.x up to 6.0.9.
Who can exploit CVE-2018-14593?
An attacker who is already logged in as an agent in OTRS can exploit CVE-2018-14593.
What platforms are impacted by CVE-2018-14593?
CVE-2018-14593 impacts OTRS installations on Debian Linux versions 8.0 and 9.0.
- collector/security-tracker-debian
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/otrs
- canonical/otrs
- version/otrs/4.0.0
- version/otrs/4.0.30
- version/otrs/5.0.0
- version/otrs/5.0.28
- version/otrs/6.0.0
- version/otrs/6.0.9
- vendor/debian
- canonical/debian
- version/debian/8.0
- version/debian/9.0