CVE-2017-16921 (GCVE-0-2017-16921)
Vulnerability from cvelistv5 – Published: 2017-12-08 15:00 – Updated: 2024-08-05 20:35
VLAI
EPSS
VEX
Summary
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
Severity
8.8 (High)
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://www.otrs.com/security-advisory-2017-09-se… | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2017… | mailing-listx_refsource_MLIST |
| https://www.exploit-db.com/exploits/43853/ | exploitx_refsource_EXPLOIT-DB |
| https://www.debian.org/security/2017/dsa-4066 | vendor-advisoryx_refsource_DEBIAN |
| http://packetstormsecurity.com/files/162295/OTRS-… | x_refsource_MISC |
Date Public
2017-12-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:35:21.367Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/"
},
{
"name": "[debian-lts-announce] 20171219 [SECURITY] [DLA 1212-1] otrs2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html"
},
{
"name": "43853",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/43853/"
},
{
"name": "DSA-4066",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2017/dsa-4066"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-12-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-22T17:06:19.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/"
},
{
"name": "[debian-lts-announce] 20171219 [SECURITY] [DLA 1212-1] otrs2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html"
},
{
"name": "43853",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/43853/"
},
{
"name": "DSA-4066",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2017/dsa-4066"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-16921",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/",
"refsource": "CONFIRM",
"url": "https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/"
},
{
"name": "[debian-lts-announce] 20171219 [SECURITY] [DLA 1212-1] otrs2 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html"
},
{
"name": "43853",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/43853/"
},
{
"name": "DSA-4066",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2017/dsa-4066"
},
{
"name": "http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-16921",
"datePublished": "2017-12-08T15:00:00.000Z",
"dateReserved": "2017-11-21T00:00:00.000Z",
"dateUpdated": "2024-08-05T20:35:21.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2017-16921",
"date": "2026-07-15",
"epss": "0.19901",
"percentile": "0.97129"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CD316D98-1DC4-4DC7-A488-851E94CC5263\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8E9B81FE-4BA6-46B5-B390-1B05CB33C648\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5E38191D-DD62-476D-BB4A-80094B0FFD26\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"875C5002-3E08-47A4-825C-282E6476507C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CBE3222C-1C90-43D1-9E06-A9F867880900\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A6257D3-FD70-486D-B11A-77FE5904FFFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4CF6C894-111B-4432-B93B-989C8007CB6A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CADCDD21-3665-4460-845F-DE9851607673\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB52A359-2564-4E8D-929A-5402D04CDED0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FE86BC8-E092-4436-B632-8D117980D242\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"12C2FF70-9B69-43FD-872D-8E6F1CD59634\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C2661294-7039-4C6A-8BFA-D790E93415C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9B3DBFC-A962-44C3-810D-A9538E328E64\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51DFB908-1877-4C6F-BAFB-45B3B17CBE97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B96AE1B-9B8B-40D9-99AA-797859FA0EFC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B2C427B-DC2B-41F7-B3FC-BF0D51706F88\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1B4648D-E3C7-4C5D-897C-CC27F8082AC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"908263DC-2F85-4ED9-AF4A-884609B2A3F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D5F64E91-CF0C-4C48-94F0-0474A3D484F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"974BFF95-01AC-454D-97CC-A82CA8823FFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"654C711F-2C10-4E7A-BFFF-9AD911576CDE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CF723BA-E772-48F8-8B45-753CD372DCEE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A00DD7D5-EBB4-4E7F-8669-FA96FF9E6B6C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.24:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"906E3FE6-2516-474C-9F91-539A77E0085C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.25:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CDBC4C4-2FCF-46DE-B5DF-60933563AB94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:4.0.26:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA65E992-3401-4DE0-AB45-68D59063814F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E34A190-EFB8-4746-AECF-6309FE803A49\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:alpha1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F8B3028-82F5-4B21-81B9-408533C7F524\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA73A62B-BFA7-4793-96E6-BB832418A259\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DE138E72-61A0-4495-86CE-4342B93049CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"C473A55A-677C-4D0B-9C0D-D1B3857AE8BA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"D977D160-7B24-4ADD-9818-4C93A9E7D865\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:beta5:*:*:*:*:*:*\", \"matchCriteriaId\": \"472ACCD4-1B3D-4468-B084-D4E98032FF5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8838C987-53ED-4E05-99D1-57A56A899C5D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A5C00BB3-3349-4DB3-B753-B36B88E1B9B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D567DC5-332F-4F95-BA0B-B076661AB14D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8361E43E-9140-49DC-9F06-865BDFC3A60E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"00DF625C-C5B1-4B7F-BDB4-34F751093104\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0124AD54-B58F-4D36-B45F-B836C321067F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D36D023-BE8C-47EF-934E-4E808FA3C0D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56D7CD3E-A98A-4FBD-B267-E69E1711B741\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"08621604-0098-45F9-9684-85973F4C3058\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2209CD7C-0539-4A36-B40A-D437F6926444\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6F821217-A3A1-4CAC-9904-80543FD17808\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CE3BC26-B6CE-4A47-87EE-ABF098D0D553\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2B352C86-4538-4266-8FDE-AA8F4FD173AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E569B83B-4DDF-48FE-9143-57CE2D0EBA87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A54B103C-3B32-4BD9-BE83-6E8B8D43F51D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0052F432-313F-416F-A655-BB5E3E880915\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36E464C4-60E9-43C5-A42E-371B332C859B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B011E9D-C067-4362-9181-EB568C59944D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB0FD254-B891-4911-9DBC-C55E67F13C4B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5FE23C83-B4A3-4996-82A5-E19D6D43E0B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0BA401F3-9ADF-4725-825F-7E94AF6589BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B91E306F-59EC-43AC-8208-38FBBB6D2989\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B0B0D2F-29F9-4648-BB4D-81A70E429872\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5496643A-DCC8-472F-8BDB-D11A76E0B6DD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:5.0.24:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4256A6A4-A692-4709-98D4-B805E6078A78\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD3ED863-6A35-4774-90BD-C7CEC377D5F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:alpha1:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF7F16FD-2DA4-4C52-8B43-724250EED343\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"416C5325-B3B7-49C6-8CB9-C40965456A93\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"EC9D448F-0BF4-4A8B-A845-503DEA6CA85D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3771FD9B-C1C4-42D2-AB37-ED177482BCDD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E997CBD-3D10-4E08-9AA6-1A4DD5A5C796\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:beta5:*:*:*:*:*:*\", \"matchCriteriaId\": \"3E6EDA86-F295-4DB6-83D7-A54886F39F25\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"5E4F8D76-ADD7-41F6-816F-43CED6AFB061\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:6.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2491453A-3458-4D07-94A0-80A1AB8AF0DC\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"16F59A04-14CF-49E2-9973-645477EA09DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.\"}, {\"lang\": \"es\", \"value\": \"En OTRS en versiones 6.0.x hasta e incluyendo 6.0.1; OTRS 5.0.x hasta e incluyendo 5.0.24 y OTRS 4.0.x hasta e incluyendo 4.0.26, un atacante que haya iniciado sesi\\u00f3n en OTRS como agente puede manipular los par\\u00e1metros de formulario (relacionados con PGP) y ejecutar comandos shell arbitrarios con los permisos del usuario OTRS o del servidor web.\"}]",
"id": "CVE-2017-16921",
"lastModified": "2024-11-21T03:17:14.630",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:C/I:C/A:C\", \"baseScore\": 9.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2017-12-08T15:29:00.323",
"references": "[{\"url\": \"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2017/dsa-4066\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/43853/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2017/dsa-4066\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/43853/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2017-16921\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-12-08T15:29:00.323\",\"lastModified\":\"2026-05-13T00:24:29.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.\"},{\"lang\":\"es\",\"value\":\"En OTRS en versiones 6.0.x hasta e incluyendo 6.0.1; OTRS 5.0.x hasta e incluyendo 5.0.24 y OTRS 4.0.x hasta e incluyendo 4.0.26, un atacante que haya iniciado sesi\u00f3n en OTRS como agente puede manipular los par\u00e1metros de formulario (relacionados con PGP) y ejecutar comandos shell arbitrarios con los permisos del usuario OTRS o del servidor web.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"baseScore\":9.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD316D98-1DC4-4DC7-A488-851E94CC5263\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E9B81FE-4BA6-46B5-B390-1B05CB33C648\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E38191D-DD62-476D-BB4A-80094B0FFD26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"875C5002-3E08-47A4-825C-282E6476507C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBE3222C-1C90-43D1-9E06-A9F867880900\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A6257D3-FD70-486D-B11A-77FE5904FFFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CF6C894-111B-4432-B93B-989C8007CB6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CADCDD21-3665-4460-845F-DE9851607673\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB52A359-2564-4E8D-929A-5402D04CDED0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FE86BC8-E092-4436-B632-8D117980D242\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12C2FF70-9B69-43FD-872D-8E6F1CD59634\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2661294-7039-4C6A-8BFA-D790E93415C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9B3DBFC-A962-44C3-810D-A9538E328E64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51DFB908-1877-4C6F-BAFB-45B3B17CBE97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B96AE1B-9B8B-40D9-99AA-797859FA0EFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B2C427B-DC2B-41F7-B3FC-BF0D51706F88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1B4648D-E3C7-4C5D-897C-CC27F8082AC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"908263DC-2F85-4ED9-AF4A-884609B2A3F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5F64E91-CF0C-4C48-94F0-0474A3D484F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"974BFF95-01AC-454D-97CC-A82CA8823FFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"654C711F-2C10-4E7A-BFFF-9AD911576CDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CF723BA-E772-48F8-8B45-753CD372DCEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A00DD7D5-EBB4-4E7F-8669-FA96FF9E6B6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"906E3FE6-2516-474C-9F91-539A77E0085C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CDBC4C4-2FCF-46DE-B5DF-60933563AB94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:4.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA65E992-3401-4DE0-AB45-68D59063814F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E34A190-EFB8-4746-AECF-6309FE803A49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F8B3028-82F5-4B21-81B9-408533C7F524\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA73A62B-BFA7-4793-96E6-BB832418A259\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE138E72-61A0-4495-86CE-4342B93049CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C473A55A-677C-4D0B-9C0D-D1B3857AE8BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D977D160-7B24-4ADD-9818-4C93A9E7D865\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:beta5:*:*:*:*:*:*\",\"matchCriteriaId\":\"472ACCD4-1B3D-4468-B084-D4E98032FF5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8838C987-53ED-4E05-99D1-57A56A899C5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5C00BB3-3349-4DB3-B753-B36B88E1B9B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D567DC5-332F-4F95-BA0B-B076661AB14D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8361E43E-9140-49DC-9F06-865BDFC3A60E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00DF625C-C5B1-4B7F-BDB4-34F751093104\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0124AD54-B58F-4D36-B45F-B836C321067F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D36D023-BE8C-47EF-934E-4E808FA3C0D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56D7CD3E-A98A-4FBD-B267-E69E1711B741\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08621604-0098-45F9-9684-85973F4C3058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2209CD7C-0539-4A36-B40A-D437F6926444\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F821217-A3A1-4CAC-9904-80543FD17808\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CE3BC26-B6CE-4A47-87EE-ABF098D0D553\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B352C86-4538-4266-8FDE-AA8F4FD173AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E569B83B-4DDF-48FE-9143-57CE2D0EBA87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A54B103C-3B32-4BD9-BE83-6E8B8D43F51D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0052F432-313F-416F-A655-BB5E3E880915\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36E464C4-60E9-43C5-A42E-371B332C859B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B011E9D-C067-4362-9181-EB568C59944D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB0FD254-B891-4911-9DBC-C55E67F13C4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FE23C83-B4A3-4996-82A5-E19D6D43E0B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BA401F3-9ADF-4725-825F-7E94AF6589BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B91E306F-59EC-43AC-8208-38FBBB6D2989\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B0B0D2F-29F9-4648-BB4D-81A70E429872\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5496643A-DCC8-472F-8BDB-D11A76E0B6DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:5.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4256A6A4-A692-4709-98D4-B805E6078A78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD3ED863-6A35-4774-90BD-C7CEC377D5F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF7F16FD-2DA4-4C52-8B43-724250EED343\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"416C5325-B3B7-49C6-8CB9-C40965456A93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC9D448F-0BF4-4A8B-A845-503DEA6CA85D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3771FD9B-C1C4-42D2-AB37-ED177482BCDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E997CBD-3D10-4E08-9AA6-1A4DD5A5C796\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:beta5:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E6EDA86-F295-4DB6-83D7-A54886F39F25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E4F8D76-ADD7-41F6-816F-43CED6AFB061\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:6.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2491453A-3458-4D07-94A0-80A1AB8AF0DC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2017/dsa-4066\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/43853/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2017/dsa-4066\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/43853/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…