CVE-2017-17476
High
Description
Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Otrs
PublishedDec 20, 2017
First seenDec 20, 2017
How to fix
Update
- otrs otrs4.0.28, 5.0.26, 6.0.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| otrs otrs | 4.0.0 ≤ v < 4.0.28, 5.0.0 ≤ v < 5.0.26, 6.0.0 ≤ v < 6.0.3 | 4.0.28, 5.0.26, 6.0.3 |
| debian debian_linux | 7.0, 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.