UBUNTU-CVE-2018-14593

An issue was discovered in Open Ticket Request System OTRS 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL...

CVE-2018-14593

CVE-2018-14593 affects Open Ticket Request System (OTRS) versions 6.0.x up to 6.0.9, 5.0.x up to 5.0.28, and 4.0.x up to 4.0.30. An attacker authenticated as an OTRS agent can escalate privileges by accessing a specially crafted URL. Multiple security advisories (Debian, openSUSE, SUSE, OpenVAS) ...

PT-2018-12603

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 4.0.x through 4.0.30 Open Ticket Request System OTRS versions 5.0.x through 5.0.28 Open Ticket Request System OTRS versions 6.0.x through 6.0.9 Description An issue was discovered that allows an attacke...

CVE-2018-14593: Undefined Security Weakness

An issue was discovered in Open Ticket Request System OTRS 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL...

Open Ticket Request System Remote Code Execution Vulnerability

Open Ticket Request System OTRS is an open source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and the service...

UBUNTU-CVE-2018-7567

In the Admin Package Manager in Open Ticket Request System OTRS 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server...

CVE-2018-7567

In the Admin Package Manager in Open Ticket Request System OTRS 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server...

CVE-2018-7567: Unrestricted Upload of File with Dangerous Type

In the Admin Package Manager in Open Ticket Request System OTRS 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server...

CVE-2017-17476

Open Ticket Request System OTRS 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email...

PT-2017-14804

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 4.0.x through 4.0.27 Open Ticket Request System OTRS versions 5.0.x through 5.0.25 Open Ticket Request System OTRS versions 6.0.x through 6.0.2 Description The issue might allow remote attackers to hija...

CVE-2017-17476: Exposure of Sensitive Information to an Unauthorized Actor

Open Ticket Request System OTRS 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email...

CVE-2017-16854: Exposure of Sensitive Information to an Unauthorized Actor

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...

PT-2017-14599

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 3.3.20 and earlier Open Ticket Request System OTRS versions 4.0.26 and earlier Open Ticket Request System OTRS versions 5.0.24 and earlier Open Ticket Request System OTRS versions 6.0.1 and earlier...

Open Ticket Request System Code Injection Vulnerability

Open Ticket Request System OTRS is an open source defect tracking and management system software. A code injection vulnerability exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS. A remote authenticated attacker can exploit this vulnerability by executing shell commands as a...

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

CVE-2017-16664

Removed by vendor...

CVE-2017-16664: Improper Control of Generation of Code

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

Open Ticket Request System Agent Frontend Information Disclosure Vulnerability

Open Ticket Request System OTRS is an open source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and service personn...

PT-2017-14511

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 3.3 before 3.3.20 Open Ticket Request System OTRS versions 4 before 4.0.26 Open Ticket Request System OTRS versions 5 before 5.0.24 Description A code injection issue exists in the...