NetSight
IP …
high8.8

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20.

Impact

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.

Affected products

VendorProductAffected versions
OtrsOtrs
from 3.3.0 before 3.3.20
from 4.0.0 before 4.0.26
from 5.0.0 before 5.0.24
DebianDebian Linux
Versions 7.0, 8.0, 9.0

Weakness classification

CWE-94

References