CVE-2017-17476 json
Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might…
published 2017-12-20 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-8638
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.
Patch / fix
Exploit prediction
2.22% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953
patch, third-party-advisory
-
github.com
/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc
patch, third-party-advisory
-
github.com
/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb
patch, third-party-advisory
-
otrs.com
/security-advisory-2017-10-security-update-otrs-framework/
patch, vendor-advisory
-
debian.org
/security/2017/dsa-4069
vendor-advisory, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2017/12/msg00018.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2017-17476
- NVD CVE-2017-17476
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.