Vulnerability CVE-2013-4717

Vulnerability Name:

CVE-2013-4717 (CCN-85508)

Assigned:

2013-07-09

Published:

2013-07-09

Updated:

2021-08-17

Summary:

Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.

CVSS v3 Severity:

8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
5.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-89

Vulnerability Consequences:

Data Manipulation

References:

Source: MITRE
Type: CNA
CVE-2013-4717

Source: CCN
Type: SA52623
OTRS / OTRS ITSM Unspecified Script Insertion and SQL Injection Vulnerabilities

Source: CCN
Type: OTRS Web site
OTRS Help Desk software - OTRS IT Service Management software - Free Open Source Help Desk - Problem Management System - Customer Interaction Software | OTRS

Source: CCN
Type: Security Advisory 2013-05
Sql Injection + Xss Issue

Source: CCN
Type: BID-61037
OTRS and OTRS ITSM CVE-2013-4717 Unspecified SQL Injection Vulnerabilitiy

Source: XF
Type: UNKNOWN
otrs-cve20134717-sql-injection(85508)

Source: CCN
Type: OTRS Security Advisory 2013-05
OTRS

Source: MISC
Type: Patch, Vendor Advisory
https://web.archive.org/web/20130817120539/http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2013-05/

Vulnerable Configuration:

Configuration 1:

cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 3.0.0 and <= 3.0.21)

OR cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 3.1.0 and <= 3.1.17)

OR cpe:/a:otrs:otrs:*:*:*:*:*:*:*:* (Version >= 3.2.0 and <= 3.2.8)

OR cpe:/a:otrs:otrs_itsm:*:*:*:*:*:*:*:* (Version >= 3.0.0 and <= 3.0.8)

OR cpe:/a:otrs:otrs_itsm:*:*:*:*:*:*:*:* (Version >= 3.1.0 and <= 3.1.9)

OR cpe:/a:otrs:otrs_itsm:*:*:*:*:*:*:*:* (Version >= 3.2.0 and <= 3.2.6)

Configuration CCN 1:

cpe:/a:otrs:otrs:3.2.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_itsm:3.2.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_itsm:3.0.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.1.17:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs:3.0.21:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20134717	V	CVE-2013-4717	2022-06-30
oval:org.opensuse.security:def:113077	P	otrs-3.3.16-37.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106514	P	Security update for apache2 (Important) (in QA)	2022-01-10
oval:org.mitre.oval:def:18996	P	DSA-2733-1 otrs2 - SQL injection	2014-06-23
oval:com.ubuntu.bionic:def:201347170000000	V	CVE-2013-4717 on Ubuntu 18.04 LTS (bionic) - medium.	2013-07-11
oval:com.ubuntu.artful:def:20134717000	V	CVE-2013-4717 on Ubuntu 17.10 (artful) - medium.	2013-07-11
oval:com.ubuntu.xenial:def:20134717000	V	CVE-2013-4717 on Ubuntu 16.04 LTS (xenial) - medium.	2013-07-11
oval:com.ubuntu.xenial:def:201347170000000	V	CVE-2013-4717 on Ubuntu 16.04 LTS (xenial) - medium.	2013-07-11
oval:com.ubuntu.bionic:def:20134717000	V	CVE-2013-4717 on Ubuntu 18.04 LTS (bionic) - medium.	2013-07-11
oval:com.ubuntu.precise:def:20134717000	V	CVE-2013-4717 on Ubuntu 12.04 LTS (precise) - medium.	2013-07-11
oval:com.ubuntu.trusty:def:20134717000	V	CVE-2013-4717 on Ubuntu 14.04 LTS (trusty) - medium.	2013-07-11

BACK