Vulnerability CVE-2016-5843

Vulnerability Name:

CVE-2016-5843 (CCN-117027)

Assigned:

2016-07-01

Published:

2016-07-01

Updated:

2016-11-28

Summary:

Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.

CVSS v3 Severity:

9.4 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
8.2 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): Low

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Partial Availibility (A): Partial

6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-89

Vulnerability Consequences:

Data Manipulation

References:

Source: MITRE
Type: CNA
CVE-2016-5843

Source: BID
Type: UNKNOWN
93019

Source: CCN
Type: BID-93019
OTRS FAQ Package CVE-2016-5843 Multiple SQL Injection Vulnerabilities

Source: XF
Type: UNKNOWN
otrs-cve20165843-sql-injection(117027)

Source: CONFIRM
Type: Issue Tracking, Patch
https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9

Source: CONFIRM
Type: Issue Tracking, Patch
https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557

Source: CONFIRM
Type: Issue Tracking, Patch
https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3

Source: CCN
Type: OTRS Web site
otrs.com - Simple service management

Source: CCN
Type: OTRS Security Advisory 2016-01
Security Update for OTRS FAQ package

Source: CONFIRM
Type: Vendor Advisory
https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2016-5843

Vulnerable Configuration:

Configuration 1:

cpe:/a:otrs:faq:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.0.7:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.0.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.1.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.2.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.3.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.3.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:5.0.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:5.0.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:5.0.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:faq:5.0.3:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:otrs:faq:2.2.2:*:*:*:*:*:*:*