CVE-2017-14635
Fixed in a distro release EPSS 2%
In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.
Products: otrs
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | otrs2 | 5.0.23-1 |
| Debian 7 | otrs2 | 3.3.18-1~deb7u1 |
| Debian 8 | otrs2 | 3.3.18-1+deb8u1 |
| Debian 9 | otrs2 | 5.0.16-1+deb9u2 |
| Ubuntu 16.04 LTS | otrs2 | no fix |