CVE-2014-1471

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in...

7.5 HighFix available

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.

Exploit likelihood

1.77%Down 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2014-1471
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-1471
Updated: 2026-11-02

EUVDEUVD-2014-1547 No score

Record: EUVD-2014-1547
Updated: 2026-11-03

GitHub AdvisoriesGHSA-29c7-wxj9-99jf No score

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in...

Record: GHSA-29c7-wxj9-99jf
Weakness: CWE-89
Updated: 2026-11-02

OSV No score

Record: CVE-2014-1471
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-1471 No score

Record: DEBIAN-CVE-2014-1471
Updated: 2026-11-02

OSVMGASA-2014-0094 No score

Updated otrs packages fix security vulnerabilities and a missing dependency

Updated otrs package fixes security vulnerabilities:

In OTRS before 3.2.14, an attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks (CVE-2014-1694).

In OTRS before 3.2.14, an attacker with a valid customer or agent login could inject SQL in the ticket search URL (CVE-2014-1471).

The update also adds a missing dependency which prevented database creation during web based installation.

Record: MGASA-2014-0094
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-1471 No score

Record: UBUNTU-CVE-2014-1471
Updated: 2026-11-02

Affected products

otrs

Affected packages

Affected packages
Package	Affected	Fixed
`otrs2` Debian:11	before 3.3.4-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less 2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6	3.3.4-1
`otrs2` Debian:6.0 From an advisory covering 2 CVEs	before 2.4.9+dfsg1-3+squeeze5, plus listed versions 2.4.9+dfsg1-32.4.9+dfsg1-3+squeeze12.4.9+dfsg1-3+squeeze32.4.9+dfsg1-3+squeeze4	2.4.9+dfsg1-3+squeeze5
`otrs2` Debian:7 From an advisory covering 2 CVEs	before 3.1.7+dfsg1-8+deb7u4, plus listed versions 3.1.7+dfsg1-83.1.7+dfsg1-8+deb7u13.1.7+dfsg1-8+deb7u23.1.7+dfsg1-8+deb7u3	3.1.7+dfsg1-8+deb7u4
`otrs` Mageia:3 From an advisory covering 2 CVEs	before 3.2.14-1.mga3	3.2.14-1.mga3
`otrs` Mageia:4 From an advisory covering 2 CVEs	before 3.2.14-1.mga4	3.2.14-1.mga4

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-1471 is a high vulnerability (CVSS 7.5) in Otrs, published February 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in otrs2 3.3.4-1.

References

Show 16 moreShow less

This page doesn't list everything

Left out here: 85 versions. The JSON record has them.