Security Advisory

CVE-2017-9324

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-06-12 06:00:00

Last updated 2024-08-05 17:02:44

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.

← Browse all CVEs View on cve.org ↗