Bugzilla – Bug 1071797
VUL-0: CVE-2017-16921: otrs: Remote code execution for authenticated users (OSA-2017-09)
Last modified: 2017-12-16 13:36:57 UTC
An attacker who is logged into OTRS as an agent can manipulate form parameters and execute arbitrary shell commands with the permissions of the OTRS or web server user.
OTRS 3.3 is EOL. No security updates anymore.
User should update to 4.0.x at least.
This is an autogenerated message for OBS integration:
This bug (1071797) was mentioned in
https://build.opensuse.org/request/show/555150 Factory / otrs
An OTRS 5 version is being prepared in network:otrs:Test