In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an     attacker with agent permission is capable of opening a specific URL in a browser to gain administrative     privileges / full access. Afterward, all system settings can be read and changed. The URLs in question     contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended     at the end. (CVE-2017-9324)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for otrs fixes the following issues :

  - CVE-2017-9324: Incorrect Access Control in OTRS -     Improved SecureMode detection in Installer (OSA-2017-03,     bsc#1043086)

  - bsc#1043244: Reflected cross-site scripting in OTRS,     customer search should not return results for internal     (OSA-2017-02)

In addition, OTRS was updated to 3.3.17 with the following fixes :

  - Function 'SystemDataGroupGet' has problems with empty     values in oracle

  - Base64 encoded image does not display in article

  - Chrome could not display attached PDF files

Joerg-Thomas Vogt discovered that the SecureMode was insufficiently validated in the OTRS ticket system, which could allow agents to escalate their privileges.

ID	Name	Product	Family	Severity
254722	Linux Distros Unpatched Vulnerability : CVE-2017-9324	Nessus	Misc.	high
100832	openSUSE Security Update : otrs (openSUSE-2017-691)	Nessus	SuSE Local Security Checks	high
100727	Debian DSA-3876-1 : otrs2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-9324

high

Tenable Plugins

high

high

high