High severity8.8NVD Advisory· Published Nov 16, 2017· Updated Jun 17, 2026

CVE-2017-15864

Description

In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password.

Affected products

OTRS/Otrsinferred3 versions
>=3.3,<=3.3.18+ 2 more
- (no CPE)range: >=3.3,<=3.3.18
- cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*range: >=3.3.0,<=3.3.18
- (no CPE)range: 3.3.x through 3.3.18
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2017/12/msg00015.htmlnvdMailing ListThird Party Advisory
www.debian.org/security/2017/dsa-4047nvdThird Party Advisory
www.otrs.com/security-advisory-2017-06-security-update-otrs-3-3/nvdBroken LinkVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000