Search for vulnerabilities
Vulnerability details: VCID-7uhe-svuy-aaad
Vulnerability ID VCID-7uhe-svuy-aaad
Aliases CVE-2014-1694
Summary Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-352 Cross-Site Request Forgery (CSRF)
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1694.html
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00703 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.00735 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.02673 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.02673 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.02673 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
epss 0.02673 https://api.first.org/data/v1/epss?cve=CVE-2014-1694
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1471
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1694
cvssv2 6.8 https://nvd.nist.gov/vuln/detail/CVE-2014-1694
generic_textual Medium https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/
generic_textual Medium http://www.openwall.com/lists/oss-security/2014/01/29
Reference id Reference type URL
http://bugs.otrs.org/show_bug.cgi?id=10099
http://osvdb.org/102632
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1694.html
https://api.first.org/data/v1/epss?cve=CVE-2014-1694
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1471
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1694
http://secunia.com/advisories/56644
http://secunia.com/advisories/56655
https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7
https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312
https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77
https://www.otrs.com/release-notes-otrs-help-desk-3-3-4
https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface
https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/
http://www.debian.org/security/2014/dsa-2867
http://www.openwall.com/lists/oss-security/2014/01/29
http://www.openwall.com/lists/oss-security/2014/01/29/15
http://www.openwall.com/lists/oss-security/2014/01/29/7
cpe:2.3:a:otrs:otrs:3.1.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.10:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.11:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.11:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.13:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.13:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.14:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.14:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.15:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.15:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.16:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.16:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.17:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.17:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.18:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.18:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.6:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.7:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.8:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.1.9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.1.9:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.0:beta3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.0:beta3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.0:beta4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.0:beta4:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.0:beta5:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.0:beta5:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.10:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.5:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.6:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.7:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.8:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.2.9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.2.9:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.0:beta3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.0:beta3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.0:beta4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.0:beta4:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.0:beta5:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.0:beta5:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.0:rc1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:3.3.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:3.3.3:*:*:*:*:*:*:*
CVE-2014-1694 https://nvd.nist.gov/vuln/detail/CVE-2014-1694
No exploits are available.
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2014-1694
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.66111
EPSS Score 0.00573
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.