CVE-2014-1694
Summary
| CVE | CVE-2014-1694 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-02-04 21:55:05 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets. |
Risk And Classification
Primary CVSS: v2.0 6.8 from [email protected]
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 0.005840000 probability, percentile 0.691050000 (date 2026-05-04)
Problem Types: CWE-352 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Otrs | Otrs | 3.1.0 | All | All | All |
| Application | Otrs | Otrs | 3.1.1 | All | All | All |
| Application | Otrs | Otrs | 3.1.10 | All | All | All |
| Application | Otrs | Otrs | 3.1.11 | All | All | All |
| Application | Otrs | Otrs | 3.1.13 | All | All | All |
| Application | Otrs | Otrs | 3.1.14 | All | All | All |
| Application | Otrs | Otrs | 3.1.15 | All | All | All |
| Application | Otrs | Otrs | 3.1.16 | All | All | All |
| Application | Otrs | Otrs | 3.1.17 | All | All | All |
| Application | Otrs | Otrs | 3.1.18 | All | All | All |
| Application | Otrs | Otrs | 3.1.2 | All | All | All |
| Application | Otrs | Otrs | 3.1.3 | All | All | All |
| Application | Otrs | Otrs | 3.1.4 | All | All | All |
| Application | Otrs | Otrs | 3.1.5 | All | All | All |
| Application | Otrs | Otrs | 3.1.6 | All | All | All |
| Application | Otrs | Otrs | 3.1.7 | All | All | All |
| Application | Otrs | Otrs | 3.1.8 | All | All | All |
| Application | Otrs | Otrs | 3.1.9 | All | All | All |
| Application | Otrs | Otrs | 3.2.0 | All | All | All |
| Application | Otrs | Otrs | 3.2.0 | beta1 | All | All |
| Application | Otrs | Otrs | 3.2.0 | beta2 | All | All |
| Application | Otrs | Otrs | 3.2.0 | beta3 | All | All |
| Application | Otrs | Otrs | 3.2.0 | beta4 | All | All |
| Application | Otrs | Otrs | 3.2.0 | beta5 | All | All |
| Application | Otrs | Otrs | 3.2.0 | rc1 | All | All |
| Application | Otrs | Otrs | 3.2.1 | All | All | All |
| Application | Otrs | Otrs | 3.2.10 | All | All | All |
| Application | Otrs | Otrs | 3.2.2 | All | All | All |
| Application | Otrs | Otrs | 3.2.3 | All | All | All |
| Application | Otrs | Otrs | 3.2.4 | All | All | All |
| Application | Otrs | Otrs | 3.2.5 | All | All | All |
| Application | Otrs | Otrs | 3.2.6 | All | All | All |
| Application | Otrs | Otrs | 3.2.7 | All | All | All |
| Application | Otrs | Otrs | 3.2.8 | All | All | All |
| Application | Otrs | Otrs | 3.2.9 | All | All | All |
| Application | Otrs | Otrs | 3.3.0 | All | All | All |
| Application | Otrs | Otrs | 3.3.0 | beta1 | All | All |
| Application | Otrs | Otrs | 3.3.0 | beta2 | All | All |
| Application | Otrs | Otrs | 3.3.0 | beta3 | All | All |
| Application | Otrs | Otrs | 3.3.0 | beta4 | All | All |
| Application | Otrs | Otrs | 3.3.0 | beta5 | All | All |
| Application | Otrs | Otrs | 3.3.0 | rc1 | All | All |
| Application | Otrs | Otrs | 3.3.1 | All | All | All |
| Application | Otrs | Otrs | 3.3.2 | All | All | All |
| Application | Otrs | Otrs | 3.3.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory SA56655 - OTRS Cross-Site Request Forgery and SQL Injection Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| oss-security - Re: CVE Request: otrs: CSRF issue in customer web interface | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Security Advisory SA56644 - OTRS Help Desk Cross-Site Request Forgery and SQL Injection Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| oss-security - CVE Request: otrs: CSRF issue in customer web interface | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| osvdb.org/102632 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| otrs.com| Release Notes: OTRS Help Desk 3.3.4 - otrs.com | af854a3a-2127-422b-91ae-364da2661108 | www.otrs.com | |
| Fixed bug#10099: Missing challenge token checks on customer interface. · OTRS/otrs@6f324aa · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Exploit, Patch |
| otrs.com| Security Advisory 2014-01 - CSRF issue in customer web interface - otrs.com | af854a3a-2127-422b-91ae-364da2661108 | www.otrs.com | Patch, Vendor Advisory |
| Debian -- Security Information -- DSA-2867-1 otrs2 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Bug 10099 – Missing challenge token checks on customer interface | af854a3a-2127-422b-91ae-364da2661108 | bugs.otrs.org | |
| Fixed bug#10099: Missing challenge token checks on customer interface. · OTRS/otrs@92f4172 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Exploit, Patch |
| Fixed bug#10099: Missing challenge token checks on customer interface. · OTRS/otrs@ca2c339 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Exploit, Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.