UBUNTU-CVE-2017-17476

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2017-17476

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17476.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2017-17476

Related

CVE-2017-17476

Published

2017-12-20T17:29:00Z

Modified

2025-01-13T10:21:29Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.

References

Affected packages

Ubuntu:Pro:16.04:LTS / otrs2

Package

Name: otrs2
Purl: pkg:deb/ubuntu/otrs2@5.0.7-1?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.10-1

5.*

5.0.1-1

5.0.1-2

5.0.2-1

5.0.3-1

5.0.5-1

5.0.6-1

5.0.7-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:18.04:LTS / otrs2

Package

Name: otrs2
Purl: pkg:deb/ubuntu/otrs2@6.0.3-1?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.0.3-1

Affected versions

5.*

5.0.23-1

5.0.24-1

6.*

6.0.1-1

6.0.2-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "6.0.3-1",
            "binary_name": "otrs"
        },
        {
            "binary_version": "6.0.3-1",
            "binary_name": "otrs2"
        }
    ]
}