CVE-2017-16854

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.debian.org/debian-lts-announce/2017/12/msg00015.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2017/dsa-4066Third Party Advisory
https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/Broken Link
https://lists.debian.org/debian-lts-announce/2017/12/msg00015.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2017/dsa-4066Third Party Advisory
https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/Broken Link

Timeline

Published: Dec 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-168566.1The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross sit CVE-2017-168578.5It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the bac CVE-2017-168586.8The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 al CVE-2017-168596.5The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.CVE-2017-168606.1The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from versio CVE-2017-168619.8It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker CVE-2017-168624.3The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist sett CVE-2017-168636.1The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site s CVE-2017-168646.1The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross CVE-2017-168655.3The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a CVE-2017-168666.1dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.CVE-2017-168676.5Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 deauthentication frames during the delivery process, which makes it easier for (1)