CVE-2017-16921
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up...
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
- Record
CVE-2017-16921- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
- Record
CVE-2017-16921- Updated
- 2026-11-02
EUVDEUVD-2017-8091 No score
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
- Record
EUVD-2017-8091- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9qc-g4w7-x2hf
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up...
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
- Record
GHSA-x9qc-g4w7-x2hf- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
- Record
CVE-2017-16921- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16921
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
- Record
DEBIAN-CVE-2017-16921- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16921
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
- Record
UBUNTU-CVE-2017-16921- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 |
before 6.0.2-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 |
6.0.2-1 |
otrs2Debian:7 From an advisory covering 4 CVEs |
before 3.3.18-1~deb7u2, plus listed versions 3.1.10+dfsg1-13.1.11+dfsg1-13.1.12+dfsg1-13.1.12+dfsg1-23.1.12+dfsg1-3 Show 44 moreShow less3.1.7+dfsg1-83.1.7+dfsg1-8+deb7u13.1.7+dfsg1-8+deb7u23.1.7+dfsg1-8+deb7u33.1.7+dfsg1-8+deb7u43.1.7+dfsg1-8+deb7u53.1.7+dfsg1-8+deb7u63.1.8+dfsg1-13.1.9+dfsg1-13.2.1+dfsg1-13.2.10-13.2.10-23.2.11-13.2.11-1~bpo70+13.2.12-13.2.2+dfsg1-13.2.3+dfsg1-13.2.4-13.2.5-13.2.6-13.2.6-23.2.7-13.2.7-23.2.8-13.2.9-13.2.9-23.3.1-13.3.10-13.3.11-13.3.18-1~deb7u13.3.2-13.3.3-13.3.3-23.3.3-33.3.4-13.3.5-13.3.6-13.3.7-13.3.7-23.3.8-13.3.9-13.3.9-23.3.9-33.3.9-3~bpo70+1 |
3.3.18-1~deb7u2 |
otrs2Debian:8 From an advisory covering 2 CVEs |
before 3.3.18-1+deb8u3, plus listed versions 3.3.10-13.3.11-13.3.18-1+deb8u13.3.18-1+deb8u23.3.18-1~deb7u1 Show 4 moreShow less3.3.18-1~deb7u23.3.18-1~deb7u33.3.9-33.3.9-3+deb8u1 |
3.3.18-1+deb8u3 |
otrs2Debian:9 From an advisory covering 2 CVEs |
before 5.0.16-1+deb9u4, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 |
5.0.16-1+deb9u4 |
otrs2Ubuntu:16.04:LTS |
All versions, plus listed versions 4.0.10-15.0.1-15.0.1-25.0.2-15.0.3-15.0.5-15.0.6-15.0.7-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OTRS 5.0.x/6.0.x - Remote Command Execution (1) | 2018-01-21 |
| PoC in GitHub | Smarttfoxx/OTRS-4.0.1-6.0.1-Remote-Command-Execution | 2024-08-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16921 is a high vulnerability (CVSS 8.8) in Otrs, published December 8, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.9%, the 97th percentile. Fixed in otrs2 6.0.2-1.
References
otrs.com/security-advisory-2017-09-security-update-otrs-framework
lists.debian.org/debian-lts-announce/2017/12/msg00015.html
exploit-db.com/exploits/43853
debian.org/security/2017/dsa-4066
packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html
nvd.nist.gov/vuln/detail/CVE-2017-16921
Left out here: 289 versions. The JSON record has them.