CVE-2017-16854 — Sensitive Information Exposure in Otrs

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 41.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Otrs2OtrsDebian Linux
Timeline
PublishedDec 8
Latest updateMay 14

Description

In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶debiandebian/otrs2< otrs2 6.0.2-1 (bullseye)
▶NVDotrs/otrs3.3.0 — 3.3.20+3

Also affects: Debian Linux 7.0, 8.0, 9.0

🔴Vulnerability Details

2
GHSA
GHSA-29ch-39m4-vcw5: In Open Ticket Request System (OTRS) through 3↗2022-05-14
▶
OSV
CVE-2017-16854: In Open Ticket Request System (OTRS) through 3↗2017-12-08
▶

📋Vendor Advisories

1
Debian
CVE-2017-16854: otrs2 - In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through...↗2017
▶
CVE-2017-16854 — Sensitive Information Exposure in Otrs | cvebase