CVE-2018-16587

In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.

CVSS v3.0 6.5 MEDIUM
CVSS v2.0 5.8 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://lists.debian.org/debian-lts-announce/2018/09/msg00033.html	Mailing List Third Party Advisory
https://github.com/OTRS/otrs/commit/d9db0c6a15caafda7689320ecf61777993c33711	Patch
https://github.com/OTRS/otrs/commit/d8cae00b0f78c2a07bb10cedb817304139395843	Patch
https://github.com/OTRS/otrs/commit/a4a1a01f84fac7ab032570ee50b660e2ebb15c01	Patch
https://community.otrs.com/security-advisory-2018-04-security-update-for-otrs-framework/	Patch Vendor Advisory
https://www.debian.org/security/2018/dsa-4317	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:otrs:open_ticket_request_system::::::::
	cpe:2.3:a:otrs:open_ticket_request_system::::::::
	cpe:2.3:a:otrs:open_ticket_request_system::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

Information

Published : 2018-09-27 17:29

Updated : 2018-11-21 09:55

NVD link : CVE-2018-16587

Mitre link : CVE-2018-16587

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

debian

debian_linux

otrs

open_ticket_request_system

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00033.html", "name": "[debian-lts-announce] 20180926 [SECURITY] [DLA 1521-1] otrs2 security update", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://github.com/OTRS/otrs/commit/d9db0c6a15caafda7689320ecf61777993c33711", "name": "https://github.com/OTRS/otrs/commit/d9db0c6a15caafda7689320ecf61777993c33711", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "https://github.com/OTRS/otrs/commit/d8cae00b0f78c2a07bb10cedb817304139395843", "name": "https://github.com/OTRS/otrs/commit/d8cae00b0f78c2a07bb10cedb817304139395843", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "https://github.com/OTRS/otrs/commit/a4a1a01f84fac7ab032570ee50b660e2ebb15c01", "name": "https://github.com/OTRS/otrs/commit/a4a1a01f84fac7ab032570ee50b660e2ebb15c01", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "https://community.otrs.com/security-advisory-2018-04-security-update-for-otrs-framework/", "name": "https://community.otrs.com/security-advisory-2018-04-security-update-for-otrs-framework/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://www.debian.org/security/2018/dsa-4317", "name": "DSA-4317", "tags": ["Third Party Advisory"], "refsource": "DEBIAN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-16587", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2018-09-28T00:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:otrs:open_ticket_request_system:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.0.11", "versionStartIncluding": "6.0.0"}, {"cpe23Uri": "cpe:2.3:a:otrs:open_ticket_request_system:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.0.30", "versionStartIncluding": "5.0.0"}, {"cpe23Uri": "cpe:2.3:a:otrs:open_ticket_request_system:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.0.32", "versionStartIncluding": "4.0.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-11-21T17:55Z"}