CVE-2017-14635
N/A
Published: September 21, 2017 at 01:00 PM UTC
Updated: June 17, 2026 at 01:06 AM UTC
1 product affected across 1 vendorOTRS
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 2%
Description
In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
3.3.03.3.0 beta13.3.0 beta23.3.0 beta33.3.0 beta43.3.0 beta53.3.0 rc13.3.13.3.103.3.113.3.123.3.133.3.143.3.153.3.163.3.173.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.94.0.0 beta14.0.0 beta24.0.0 beta34.0.0 beta44.0.0 beta54.0.0 rc14.0.14.0.104.0.114.0.124.0.134.0.144.0.154.0.164.0.174.0.184.0.194.0.24.0.204.0.214.0.224.0.234.0.244.0.34.0.44.0.54.0.64.0.74.0.84.0.95.0.0 beta15.0.0 beta25.0.0 beta35.0.0 beta45.0.0 beta55.0.0 rc15.0.15.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.25.0.205.0.215.0.225.0.35.0.45.0.55.0.65.0.75.0.85.0.9
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (2)
Vendor Advisoryx_refsource_DEBIAN
Source: [email protected]
https://www.debian.org/security/2017/dsa-4021x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.otrs.com/security-advisory-2017-04-security-update-otrs-versions/Quick Info
StatusMODIFIED
CWE
CWE-20
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card