CVE-2017-17476

8.8 HIGH

Published: December 20, 2017 Modified: May 13, 2026

Description

Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb

Source: cve@mitre.org

Patch Third Party Advisory

https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc

Source: cve@mitre.org

Patch Third Party Advisory

https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953

Source: cve@mitre.org

Patch Third Party Advisory

https://lists.debian.org/debian-lts-announce/2017/12/msg00018.html

Source: cve@mitre.org

Mailing List Third Party Advisory

https://www.debian.org/security/2017/dsa-4069

Source: cve@mitre.org

Third Party Advisory

https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/

Source: cve@mitre.org

Patch Vendor Advisory

https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb