CVE-2017-9324

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3876Third Party Advisory
https://packetstormsecurity.com/files/142862/OTRS-Install-Dialog-Disclosure.htmlMailing List, Third Party Advisory, VDB Entry
https://www.otrs.com/security-advisory-2017-03-security-update-otrs-versions/Vendor Advisory
http://www.debian.org/security/2017/dsa-3876Third Party Advisory
https://packetstormsecurity.com/files/142862/OTRS-Install-Dialog-Disclosure.htmlMailing List, Third Party Advisory, VDB Entry
https://www.otrs.com/security-advisory-2017-03-security-update-otrs-versions/Vendor Advisory

Timeline

Published: Jun 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-93257.5The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.CVE-2017-93267.5The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed CVE-2017-93276.5Secret data of processes managed by CM is not secured by file permissions.CVE-2017-93289.8Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execu CVE-2017-93305.6QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of ser CVE-2017-93315.4The Agenda component in Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Utils/RecordBrowser CVE-2017-93326.1The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the CVE-2017-93338.8OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, w CVE-2017-93347.5An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to CVE-2017-93366.1The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.CVE-2017-93376.1The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.CVE-2017-93385.4Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6