SQL Injection in Otrs Faq
CVE-2016-5843
Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
Vulnerability class: SQL Injection
EPSS: 0.032 (86.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
Affected products
- Otrs Faq — versions 2.0.1, 2.0.2, 2.0.3
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Issue Tracking)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Issue Tracking)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Issue Tracking)
Frequently asked questions
- What is CVE-2016-5843?
- CVE-2016-5843 is a critical-severity vulnerability in Otrs Faq, classified under SQL Injection. CVSS score: 9.4/10. Published 2016-09-17.
- How severe is CVE-2016-5843?
- Critical severity. CVSS v3 base score is 9.4 out of 10.