CVE-2017-16664
21.11.2017, 14:29
Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.
| Vendor | Product | Version |
|---|---|---|
| otrs | otrs | 3.3.0 ≤ 𝑥 < 3.3.20 |
| otrs | otrs | 4.0.0 ≤ 𝑥 < 4.0.26 |
| otrs | otrs | 5.0.0 ≤ 𝑥 < 5.0.24 |
| debian | debian_linux | 7.0 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
References