Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

Debian 8 DLA-1592-1 Critical OTRS2 Privilege Escalation Advisory

debian lts
Calendar Grey November 23, 2018
Dist Debian Esm H88
Several vulnerabilities in OTRS pose risks of unauthorized access or file alteration. It is advisable to apply updates for Debian installations.
Two security vulnerabilities were discovered in OTRS, a Ticket Request System, that may lead to privilege escalation or arbitrary file write
Topics%20covered

Topics Covered

security advisory security issue critical debian privilege escalation otrs file write

Summary

An attacker who is logged into OTRS as an admin user may manipulate
the URL to cause execution of JavaScript in the context of OTRS.

CVE-2018-19143

An attacker who is logged into OTRS as a user may manipulate the
submission form to cause deletion of arbitrary files that the OTRS
web server user has write access to.

Please also read the upstream advisory for CVE-2018-19141. If you
think you might be affected then you should consider to run the
mentioned clean-up SQL statements to remove possible affected records.

https://otrs.com/es/soluciones-de-software-otrs/otrs-community-edition/

For Debian 8 "Jessie", these problems have been fixed in version
3.3.18-1+deb8u7.

We recommend that you upgrade your otrs2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: otrs2
Version: 3.3.18-1+deb8u7
CVE ID: CVE-2018-19141 CVE-2018-19143

Topics%20covered

Topics Covered

security advisory security issue critical debian privilege escalation otrs file write

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.