What’s Vulnerable › Vulnerabilities

CVE-2017-14635

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-09-21 · updated 2026-06-17
• Weakness: CWE-20

Description

In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.

Affected products

• OTRS AG OTRS: 3.3.0, 3.3.0-beta1, 3.3.0-beta2, 3.3.0-beta3, 3.3.0-beta4, 3.3.0-beta5 (+76)

References

• https://www.debian.org/security/2017/dsa-4021
• https://www.otrs.com/security-advisory-2017-04-security-update-otrs-versions/
• https://www.debian.org/security/2017/dsa-4021
• https://www.otrs.com/security-advisory-2017-04-security-update-otrs-versions/

Get alerted when CVE-2017-14635 or the next vulnerability affects your stack