VDB
CVE-2017-16921
CVE-2017-16921
PUBLISHED
CVSS 8.800000190734863 HIGH
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
EPSS 19.90% · 97.4th percentile
Risk Scores
CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
19.90%
97.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | otrs2 | 0, 4.0.10-1, 5.0.1-1 |
Timeline
- Dec 8, 2017 CVE Published
- Jan 21, 2018 PoC Published
- Apr 14, 2021 EPSS Score
- Apr 22, 2021 PoC Published
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jul 5, 2022 EPSS Score
- Nov 9, 2022 EPSS Score
- Jan 11, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-16921 advisory
- https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/ third-party-advisory
- https://bugs.otrs.org/show_bug.cgi?id=13357 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-16921 third-party-advisory