PT-2017-14804

CVE-2017-17476

Published

2017-12-20

Updated

2026-10-31

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions 4.0.x through 4.0.27 Open Ticket Request System (OTRS) versions 5.0.x through 5.0.25 Open Ticket Request System (OTRS) versions 6.0.x through 6.0.2

Description The issue might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email when cookie support is disabled.

Recommendations For versions 4.0.x through 4.0.27, update to version 4.0.28 or later. For versions 5.0.x through 5.0.25, update to version 5.0.26 or later. For versions 6.0.x through 6.0.2, update to version 6.0.3 or later.

Exploitability

Fix

Impacts

Researchers

Francesco Sirocco

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2017-17476

ALT-PU-2019-3068