CVE-2014-1694
published 2014-02-04CVE-2014-1694: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4)…
PriorityP430medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.48%
70.7th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | otrs2 | < otrs2 3.3.4-1 (bullseye) | otrs2 3.3.4-1 (bullseye) |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2014-1694: otrs2 - Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPrefer...
vendor_debian·2014·CVSS 6.8
CVE-2014-1694 [MEDIUM] CVE-2014-1694: otrs2 - Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPrefer...
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
Scope: local
bullseye: resolved (fixed in 3.3.4-1)
GHSA
GHSA-gvjm-c4hq-cvw7: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences
ghsa_unreviewed·2022-05-17
CVE-2014-1694 [MEDIUM] CWE-352 GHSA-gvjm-c4hq-cvw7: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
OSV
CVE-2014-1694: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences
osv·2014-02-04·CVSS 6.8
CVE-2014-1694 [MEDIUM] CVE-2014-1694: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
No detection rules found.
No writeups or analysis indexed.
http://bugs.otrs.org/show_bug.cgi?id=10099http://osvdb.org/102632http://secunia.com/advisories/56644http://secunia.com/advisories/56655http://www.debian.org/security/2014/dsa-2867http://www.openwall.com/lists/oss-security/2014/01/29/15http://www.openwall.com/lists/oss-security/2014/01/29/7https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77https://www.otrs.com/release-notes-otrs-help-desk-3-3-4https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interfacehttp://bugs.otrs.org/show_bug.cgi?id=10099http://osvdb.org/102632http://secunia.com/advisories/56644http://secunia.com/advisories/56655http://www.debian.org/security/2014/dsa-2867http://www.openwall.com/lists/oss-security/2014/01/29/15http://www.openwall.com/lists/oss-security/2014/01/29/7https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77https://www.otrs.com/release-notes-otrs-help-desk-3-3-4https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface
2014-02-04
Published