8.8

CVE-2017-14635: otrs Improper Input Validation

CVSS: 8.8v3.0HighModified
AliasesUBUNTU-CVE-2017-14635DEBIAN-CVE-2017-14635DSA-4021-1
Published 21-09-2017Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2017-14635 is a high (CVSS 8.8) Improper Input Validation vulnerability in otrs. EPSS estimates a 1.92% chance of exploitation in the next 30 days, higher than 79.6% of scored vulnerabilities.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.0 (NVD)
EPSS score
1.92%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
DLA-1119-1

Timeline

  1. 21-09-2017
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.92%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

0.00 pp

From 1.92% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.92%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • otrs2< 5.0.23-1 | < 3.3.18-1+deb8u1 | < 5.0.16-1+deb9u2
Otrs1 product
  • otrs3.3.0 | 3.3.0:beta1 | 3.3.0:beta2 | 3.3.0:beta3 | 3.3.0:beta4 | 3.3.0:beta5 | 3.3.0:rc1 | 3.3.1 | 3.3.2 | 3.3.3 | 3.3.4 | 3.3.5 | 3.3.6 | 3.3.7 | 3.3.8 | 3.3.9 | 3.3.10 | 3.3.11 | 3.3.12 | 3.3.13 | 3.3.14 | 3.3.15 | 3.3.16 | 3.3.17 | 4.0.0:beta1 | 4.0.0:beta2 | 4.0.0:beta3 | 4.0.0:beta4 | 4.0.0:beta5 | 4.0.0:rc1 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.0.5 | 4.0.6 | 4.0.7 | 4.0.8 | 4.0.9 | 4.0.10 | 4.0.11 | 4.0.12 | 4.0.13 | 4.0.14 | 4.0.15 | 4.0.16 | 4.0.17 | 4.0.18 | 4.0.19 | 4.0.20 | 4.0.21 | 4.0.22 | 4.0.23 | 4.0.24 | 5.0.0:beta1 | 5.0.0:beta2 | 5.0.0:beta3 | 5.0.0:beta4 | 5.0.0:beta5 | 5.0.0:rc1 | 5.0.1 | 5.0.2 | 5.0.3 | 5.0.4 | 5.0.5 | 5.0.6 | 5.0.7 | 5.0.8 | 5.0.9 | 5.0.10 | 5.0.11 | 5.0.12 | 5.0.13 | 5.0.14 | 5.0.15 | 5.0.16 | 5.0.17 | 5.0.18 | 5.0.19 | 5.0.20 | 5.0.21 | 5.0.22
Ubuntu1 product
  • otrs2All versions (No fix recorded)

3 vendors · 3 products

References

5 links