CVE-2018-16587: Input Validation
Published Sep 28, 2018
·Updated
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.
Affected Software
6 affected componentsFixes available
debian/otrs2
6.0.16-26.0.16-2+deb10u16.0.32-6
OTRS Open Ticket Request System>=4.0.0<4.0.32
OTRS Open Ticket Request System>=5.0.0<5.0.30
OTRS Open Ticket Request System>=6.0.0<6.0.11
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Event History
Sep 28, 2018
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-16587?
CVE-2018-16587 has a high severity rating due to the risk of arbitrary file deletion by an attacker.
2
How do I fix CVE-2018-16587?
To fix CVE-2018-16587, upgrade your OTRS system to versions 4.0.32, 5.0.30, or 6.0.11 and later.
3
Which versions of OTRS are affected by CVE-2018-16587?
CVE-2018-16587 affects OTRS versions prior to 4.0.32, 5.0.30, and 6.0.11.
4
Can CVE-2018-16587 lead to data compromise?
Yes, CVE-2018-16587 can lead to data compromise through the deletion of sensitive files.
5
What type of attack is associated with CVE-2018-16587?
CVE-2018-16587 is associated with a malicious email attack targeting OTRS systems.