CVE-2017-9324

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-12 · updated 2026-06-17
Weakness: CWE-269

Description

In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.

Affected products

Debian Linux: 8.0, 9.0
OTRS AG OTRS: from 3.3.0 through 3.3.16; from 4.0.0 through 4.0.23; from 5.0.0 through 5.0.19

References

http://www.debian.org/security/2017/dsa-3876
https://packetstormsecurity.com/files/142862/OTRS-Install-Dialog-Disclosure.html
https://www.otrs.com/security-advisory-2017-03-security-update-otrs-versions/
http://www.debian.org/security/2017/dsa-3876
https://packetstormsecurity.com/files/142862/OTRS-Install-Dialog-Disclosure.html
https://www.otrs.com/security-advisory-2017-03-security-update-otrs-versions/

Get alerted when CVE-2017-9324 or the next vulnerability affects your stack