CVE Feed

    Dashboard / CVE / CVE-2014-1694

    CVE-2014-1694

    Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.

    Published:Feb 4, 2014
    Last Modified:Apr 11, 2025
    EPS:Feb 4, 2014
    EPSS Score:0.00573
    CVSS Score:6.8

    Affected Products

    Vendor
    Otrs
    Product
    Otrs

    Exploits

    https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77

    Related CVEs

    CVE-2026-48187 (CVSS 5.7) — An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows exc…
    CVE-2026-48188 (CVSS 9.1) — An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows …
    CVE-2026-48189 (CVSS 5.7) — An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer informati…
    CVE-2026-48190 (CVSS 3.5) — An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authe…
    CVE-2026-48191 (CVSS 3.5) — An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search A…
    CVE-2026-48208 (CVSS 6.5) — An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article renderin…
    CVE-2026-48209 (CVSS 7.1) — An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling al…
    CVE-2026-48210 (CVSS 5.7) — An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is…
    CVE-2026-6060 (CVSS 4.5) — A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption le…
    CVE-2025-24391 (CVSS 5.3) — A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user a…

    References

    http://bugs.otrs.org/show_bug.cgi?id=10099
    http://osvdb.org/102632
    http://secunia.com/advisories/56644
    http://secunia.com/advisories/56655
    http://www.debian.org/security/2014/dsa-2867
    http://www.openwall.com/lists/oss-security/2014/01/29/15
    http://www.openwall.com/lists/oss-security/2014/01/29/7
    https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7
    https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312
    https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77
    https://www.otrs.com/release-notes-otrs-help-desk-3-3-4
    https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface
    http://bugs.otrs.org/show_bug.cgi?id=10099
    http://osvdb.org/102632
    http://secunia.com/advisories/56644
    http://secunia.com/advisories/56655
    http://www.debian.org/security/2014/dsa-2867
    http://www.openwall.com/lists/oss-security/2014/01/29/15
    http://www.openwall.com/lists/oss-security/2014/01/29/7
    https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7
    https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312
    https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77
    https://www.otrs.com/release-notes-otrs-help-desk-3-3-4
    https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High