CVE-2013-4717
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x...
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
- Record
CVE-2013-4717- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
- Record
CVE-2013-4717- Updated
- 2026-11-02
EUVDEUVD-2013-4568 No score
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
- Record
EUVD-2013-4568- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8pr4-q5mj-2m5q No score
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x...
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
- Record
GHSA-8pr4-q5mj-2m5q- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
- Record
CVE-2013-4717- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4717
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
- Record
DEBIAN-CVE-2013-4717- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4717
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.
- Record
UBUNTU-CVE-2013-4717- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2013-0247 No score
Updated otrs package fixes security vulnerability
It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise user-supplied data that is used on SQL queries. An attacker with a valid agent login could exploit this issue to craft SQL queries by injecting arbitrary SQL code through manipulated URLs (CVE-2013-4717).
- Record
MGASA-2013-0247- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10073-1 No score
otrs-3.3.16-37.1 on GA media
These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10073-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 |
before 3.2.9-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 |
3.2.9-1 |
otrs2Debian:6.0 |
before 2.4.9+dfsg1-3+squeeze4, plus listed versions 2.4.9+dfsg1-32.4.9+dfsg1-3+squeeze12.4.9+dfsg1-3+squeeze3 |
2.4.9+dfsg1-3+squeeze4 |
otrs2Debian:7 |
before 3.1.7+dfsg1-8+deb7u3, plus listed versions 3.1.7+dfsg1-83.1.7+dfsg1-8+deb7u13.1.7+dfsg1-8+deb7u2 |
3.1.7+dfsg1-8+deb7u3 |
otrsMageia:2 |
before 3.2.9-1.mga2 | 3.2.9-1.mga2 |
otrsMageia:3 |
before 3.2.9-1.mga3 | 3.2.9-1.mga3 |
otrsopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.3.14-37.1 | 3.3.14-37.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4717 is a high vulnerability (CVSS 8.8) in Otrs, published August 2, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 71st percentile. Fixed in otrs2 3.2.9-1.
References
web.archive.org/web/20130817120539/http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2013-05
nvd.nist.gov/vuln/detail/CVE-2013-4717
github.com/advisories/GHSA-8pr4-q5mj-2m5q
security-tracker.debian.org/tracker/CVE-2013-4717
advisories.mageia.org/MGASA-2013-0247.html
bugs.mageia.org/show_bug.cgi?id=10927
Show 17 moreShow less
debian.org/security/2013/dsa-2733
ubuntu.com/security/CVE-2013-4717
cve.org/CVERecord?id=CVE-2013-4717
suse.com/security/cve/CVE-2012-2582
Left out here: 73 versions. The JSON record has them.