Open Ticket Request System (OTRS) 3.3.5

CPE Details

Open Ticket Request System (OTRS) 3.3.5
otrs
otrs
3.3.5
2014-04-02
17h06 +00:00
2014-04-10
16h42 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:otrs:otrs:3.3.5:*:*:*:*:*:*:*

Informations

Vendor

otrs

Product

otrs

Version

3.3.5

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-36100 2022-03-21 09h15 +00:00 Specially crafted string in OTRS system configuration can allow the execution of any system command.
8.8
High
CVE-2020-1778 2020-11-23 15h32 +00:00 When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions.
4.3
Medium
CVE-2017-16854 2017-12-08 16h00 +00:00 In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets.
6.5
Medium
CVE-2017-16664 2017-11-21 13h00 +00:00 Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.
8.8
High
CVE-2017-15864 2017-11-16 14h00 +00:00 In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password.
8.8
High
CVE-2017-14635 2017-09-21 11h00 +00:00 In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.
8.8
High
CVE-2017-9324 2017-06-12 04h00 +00:00 In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.
8.8
High
CVE-2016-9139 2017-02-16 17h00 +00:00 Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.
6.1
Medium
CVE-2014-2554 2014-04-23 12h00 +00:00 OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
4.3
CVE-2014-2553 2014-04-02 12h00 +00:00 Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.
3.5
CVE-2011-2385 2011-07-19 18h00 +00:00 The iPhoneHandle package 0.9.x before 0.9.7 and 1.0.x before 1.0.3 in Open Ticket Request System (OTRS) does not properly restrict use of the iPhoneHandle interface, which allows remote authenticated users to gain privileges, and consequently read or modify OTRS core objects, via unspecified vectors.
6.5