{"api_version":"1","generated_at":"2026-07-23T09:37:34+00:00","cve":"CVE-2017-16921","urls":{"html":"https://cve.report/CVE-2017-16921","api":"https://cve.report/api/cve/CVE-2017-16921.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-16921","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-16921"},"summary":{"title":"CVE-2017-16921","description":"In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-12-08 15:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-78","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"8.8","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9","severity":"","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html","name":"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] [DLA 1212-1] otrs2 security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html","name":"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"OTRS 6.0.1 Remote Command Execution ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.exploit-db.com/exploits/43853/","name":"https://www.exploit-db.com/exploits/43853/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"OTRS 5.0.x/6.0.x - Remote Command Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/","name":"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"],"title":"Security Advisory 2017-09: Security Update for OTRS Framework - otrs.com| OTRS Simple Service Management","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2017/dsa-4066","name":"https://www.debian.org/security/2017/dsa-4066","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"Debian -- Security Information -- DSA-4066-1 otrs2","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16921","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16921","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.16","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.17","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.18","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.19","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.21","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.22","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.23","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.24","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.25","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.26","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"4.0.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"alpha1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"beta3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"beta4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"beta5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.0","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.16","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.17","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.18","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.19","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.21","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.22","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.23","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.24","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"5.0.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"alpha1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"beta3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"beta4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"beta5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.0","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"16921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"6.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"16921","cve":"CVE-2017-16921","epss":"0.338690000","percentile":"0.970140000","score_date":"2026-05-17","updated_at":"2026-05-18 00:00:13"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T20:35:21.367Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/"},{"name":"[debian-lts-announce] 20171219 [SECURITY] [DLA 1212-1] otrs2 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html"},{"name":"43853","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/43853/"},{"name":"DSA-4066","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"https://www.debian.org/security/2017/dsa-4066"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-12-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-04-22T17:06:19.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/"},{"name":"[debian-lts-announce] 20171219 [SECURITY] [DLA 1212-1] otrs2 security update","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html"},{"name":"43853","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/43853/"},{"name":"DSA-4066","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"https://www.debian.org/security/2017/dsa-4066"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-16921","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/","refsource":"CONFIRM","url":"https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/"},{"name":"[debian-lts-announce] 20171219 [SECURITY] [DLA 1212-1] otrs2 security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html"},{"name":"43853","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/43853/"},{"name":"DSA-4066","refsource":"DEBIAN","url":"https://www.debian.org/security/2017/dsa-4066"},{"name":"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2017-16921","datePublished":"2017-12-08T15:00:00.000Z","dateReserved":"2017-11-21T00:00:00.000Z","dateUpdated":"2024-08-05T20:35:21.367Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-12-08 15:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-78","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.1:*:*:*:*:*:*:*","matchCriteriaId":"CD316D98-1DC4-4DC7-A488-851E94CC5263"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.2:*:*:*:*:*:*:*","matchCriteriaId":"8E9B81FE-4BA6-46B5-B390-1B05CB33C648"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.3:*:*:*:*:*:*:*","matchCriteriaId":"5E38191D-DD62-476D-BB4A-80094B0FFD26"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.4:*:*:*:*:*:*:*","matchCriteriaId":"875C5002-3E08-47A4-825C-282E6476507C"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.5:*:*:*:*:*:*:*","matchCriteriaId":"CBE3222C-1C90-43D1-9E06-A9F867880900"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.6:*:*:*:*:*:*:*","matchCriteriaId":"5A6257D3-FD70-486D-B11A-77FE5904FFFF"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.7:*:*:*:*:*:*:*","matchCriteriaId":"4CF6C894-111B-4432-B93B-989C8007CB6A"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.8:*:*:*:*:*:*:*","matchCriteriaId":"CADCDD21-3665-4460-845F-DE9851607673"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.9:*:*:*:*:*:*:*","matchCriteriaId":"DB52A359-2564-4E8D-929A-5402D04CDED0"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.10:*:*:*:*:*:*:*","matchCriteriaId":"7FE86BC8-E092-4436-B632-8D117980D242"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.11:*:*:*:*:*:*:*","matchCriteriaId":"12C2FF70-9B69-43FD-872D-8E6F1CD59634"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.12:*:*:*:*:*:*:*","matchCriteriaId":"C2661294-7039-4C6A-8BFA-D790E93415C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.13:*:*:*:*:*:*:*","matchCriteriaId":"D9B3DBFC-A962-44C3-810D-A9538E328E64"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.14:*:*:*:*:*:*:*","matchCriteriaId":"51DFB908-1877-4C6F-BAFB-45B3B17CBE97"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.15:*:*:*:*:*:*:*","matchCriteriaId":"0B96AE1B-9B8B-40D9-99AA-797859FA0EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.16:*:*:*:*:*:*:*","matchCriteriaId":"0B2C427B-DC2B-41F7-B3FC-BF0D51706F88"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.17:*:*:*:*:*:*:*","matchCriteriaId":"C1B4648D-E3C7-4C5D-897C-CC27F8082AC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.18:*:*:*:*:*:*:*","matchCriteriaId":"908263DC-2F85-4ED9-AF4A-884609B2A3F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.19:*:*:*:*:*:*:*","matchCriteriaId":"D5F64E91-CF0C-4C48-94F0-0474A3D484F5"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.20:*:*:*:*:*:*:*","matchCriteriaId":"974BFF95-01AC-454D-97CC-A82CA8823FFF"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.21:*:*:*:*:*:*:*","matchCriteriaId":"654C711F-2C10-4E7A-BFFF-9AD911576CDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.22:*:*:*:*:*:*:*","matchCriteriaId":"0CF723BA-E772-48F8-8B45-753CD372DCEE"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.23:*:*:*:*:*:*:*","matchCriteriaId":"A00DD7D5-EBB4-4E7F-8669-FA96FF9E6B6C"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.24:*:*:*:*:*:*:*","matchCriteriaId":"906E3FE6-2516-474C-9F91-539A77E0085C"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.25:*:*:*:*:*:*:*","matchCriteriaId":"6CDBC4C4-2FCF-46DE-B5DF-60933563AB94"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:4.0.26:*:*:*:*:*:*:*","matchCriteriaId":"CA65E992-3401-4DE0-AB45-68D59063814F"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:*:*:*:*:*:*:*","matchCriteriaId":"9E34A190-EFB8-4746-AECF-6309FE803A49"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:alpha1:*:*:*:*:*:*","matchCriteriaId":"8F8B3028-82F5-4B21-81B9-408533C7F524"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"CA73A62B-BFA7-4793-96E6-BB832418A259"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"DE138E72-61A0-4495-86CE-4342B93049CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"C473A55A-677C-4D0B-9C0D-D1B3857AE8BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:beta4:*:*:*:*:*:*","matchCriteriaId":"D977D160-7B24-4ADD-9818-4C93A9E7D865"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:beta5:*:*:*:*:*:*","matchCriteriaId":"472ACCD4-1B3D-4468-B084-D4E98032FF5C"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"8838C987-53ED-4E05-99D1-57A56A899C5D"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"A5C00BB3-3349-4DB3-B753-B36B88E1B9B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.2:*:*:*:*:*:*:*","matchCriteriaId":"0D567DC5-332F-4F95-BA0B-B076661AB14D"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.3:*:*:*:*:*:*:*","matchCriteriaId":"8361E43E-9140-49DC-9F06-865BDFC3A60E"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.4:*:*:*:*:*:*:*","matchCriteriaId":"00DF625C-C5B1-4B7F-BDB4-34F751093104"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.5:*:*:*:*:*:*:*","matchCriteriaId":"0124AD54-B58F-4D36-B45F-B836C321067F"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.6:*:*:*:*:*:*:*","matchCriteriaId":"8D36D023-BE8C-47EF-934E-4E808FA3C0D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.7:*:*:*:*:*:*:*","matchCriteriaId":"56D7CD3E-A98A-4FBD-B267-E69E1711B741"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.8:*:*:*:*:*:*:*","matchCriteriaId":"08621604-0098-45F9-9684-85973F4C3058"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.9:*:*:*:*:*:*:*","matchCriteriaId":"2209CD7C-0539-4A36-B40A-D437F6926444"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.10:*:*:*:*:*:*:*","matchCriteriaId":"6F821217-A3A1-4CAC-9904-80543FD17808"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.11:*:*:*:*:*:*:*","matchCriteriaId":"5CE3BC26-B6CE-4A47-87EE-ABF098D0D553"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.12:*:*:*:*:*:*:*","matchCriteriaId":"2B352C86-4538-4266-8FDE-AA8F4FD173AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.13:*:*:*:*:*:*:*","matchCriteriaId":"E569B83B-4DDF-48FE-9143-57CE2D0EBA87"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.14:*:*:*:*:*:*:*","matchCriteriaId":"A54B103C-3B32-4BD9-BE83-6E8B8D43F51D"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.15:*:*:*:*:*:*:*","matchCriteriaId":"0052F432-313F-416F-A655-BB5E3E880915"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.16:*:*:*:*:*:*:*","matchCriteriaId":"36E464C4-60E9-43C5-A42E-371B332C859B"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.17:*:*:*:*:*:*:*","matchCriteriaId":"0B011E9D-C067-4362-9181-EB568C59944D"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.18:*:*:*:*:*:*:*","matchCriteriaId":"DB0FD254-B891-4911-9DBC-C55E67F13C4B"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.19:*:*:*:*:*:*:*","matchCriteriaId":"5FE23C83-B4A3-4996-82A5-E19D6D43E0B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.20:*:*:*:*:*:*:*","matchCriteriaId":"0BA401F3-9ADF-4725-825F-7E94AF6589BC"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.21:*:*:*:*:*:*:*","matchCriteriaId":"B91E306F-59EC-43AC-8208-38FBBB6D2989"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.22:*:*:*:*:*:*:*","matchCriteriaId":"0B0B0D2F-29F9-4648-BB4D-81A70E429872"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.23:*:*:*:*:*:*:*","matchCriteriaId":"5496643A-DCC8-472F-8BDB-D11A76E0B6DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:5.0.24:*:*:*:*:*:*:*","matchCriteriaId":"4256A6A4-A692-4709-98D4-B805E6078A78"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:*:*:*:*:*:*:*","matchCriteriaId":"DD3ED863-6A35-4774-90BD-C7CEC377D5F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:alpha1:*:*:*:*:*:*","matchCriteriaId":"BF7F16FD-2DA4-4C52-8B43-724250EED343"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"416C5325-B3B7-49C6-8CB9-C40965456A93"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"EC9D448F-0BF4-4A8B-A845-503DEA6CA85D"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"3771FD9B-C1C4-42D2-AB37-ED177482BCDD"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:beta4:*:*:*:*:*:*","matchCriteriaId":"6E997CBD-3D10-4E08-9AA6-1A4DD5A5C796"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:beta5:*:*:*:*:*:*","matchCriteriaId":"3E6EDA86-F295-4DB6-83D7-A54886F39F25"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"5E4F8D76-ADD7-41F6-816F-43CED6AFB061"},{"vulnerable":true,"criteria":"cpe:2.3:a:otrs:otrs:6.0.1:*:*:*:*:*:*:*","matchCriteriaId":"2491453A-3458-4D07-94A0-80A1AB8AF0DC"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"16921","Ordinal":"1","Title":"CVE-2017-16921","CVE":"CVE-2017-16921","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"16921","Ordinal":"1","NoteData":"In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.","Type":"Description","Title":"CVE-2017-16921"},{"CveYear":"2017","CveId":"16921","Ordinal":"2","NoteData":"2017-12-08","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"16921","Ordinal":"3","NoteData":"2021-04-22","Type":"Other","Title":"Modified"}]}}}