Candidate: CVE-2017-17476
PublicDate: 2017-12-20 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17476
 https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/
 https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb
 https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc
 https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953
Description:
 Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26,
 and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote
 attackers to hijack web sessions and consequently gain privileges via a
 crafted email.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884801
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [8.8 HIGH]


Patches_otrs2:
upstream_otrs2: released (6.0.3-1)
precise/esm_otrs2: DNE
trusty_otrs2: ignored (reached end-of-life)
trusty/esm_otrs2: DNE (trusty was needed)
xenial_otrs2: ignored (end of standard support, was needed)
zesty_otrs2: ignored (reached end-of-life)
artful_otrs2: ignored (reached end-of-life)
bionic_otrs2: not-affected (6.0.3-1)
cosmic_otrs2: not-affected (6.0.3-1)
disco_otrs2: not-affected (6.0.3-1)
eoan_otrs2: not-affected (6.0.3-1)
focal_otrs2: not-affected (6.0.3-1)
groovy_otrs2: not-affected (6.0.3-1)
hirsute_otrs2: not-affected (6.0.3-1)
impish_otrs2: not-affected (6.0.3-1)
jammy_otrs2: not-affected (6.0.3-1)
devel_otrs2: not-affected (6.0.3-1)