Paper/Archive/CVE-2022-4427

CVE-2022-4427

OTRS AG OTRS — SQL Injection via OTRS Search API

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 55.4.554 × 2011.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Affected

ProductAffectedFixed inSource

OTRS7.0.1 – < 7.0.40 Patch 17.0.40 Patch 1CNA

OTRS8.0.1 – < 8.0.28 Patch 18.0.28 Patch 1CNA

((OTRS)) Community Edition6.0.1 – 6.0.34–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OTRS (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refotrs.com/release-notes/otrs-security-advisory-2022-15 reflists.debian.org/debian-lts-announce/2023/08/msg00040.html