Privilege escalation in OTRS - CVE-2017-16664

Vulnerability identifier: #VU9423

CSH Severity: High

CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2017-16664

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient security checks in the recovery procedure. A remote attacker who is logged into OTRS as an agent can request special URLs from OTRS and execute arbitrary shell commands with the permissions of the web server user.

Successful exploitation of the vulnerability may result in system compromise.

OTRS
otrs (Alpine package)

Update to version 3.3.20, 4.0.26 or 5.0.24.

otrs (Alpine package) - update to 6.0.33-r0

• https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/

• Privilege escalation in Open Ticket Request System
• OpenSUSE Linux update for otrs
• Privilege escalation in otrs (Alpine package)