CVE-2014-1695

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20...

4.3 MediumPublic exploitFix available

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.

Exploit likelihood

4.90%Up 2.5 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2014-1695
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-1695
Updated: 2026-11-02

EUVDEUVD-2014-1769 No score

Record: EUVD-2014-1769
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wf4h-3v2j-2xw9 No score

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20...

Record: GHSA-wf4h-3v2j-2xw9
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2014-1695
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-1695 No score

Record: DEBIAN-CVE-2014-1695
Updated: 2026-11-02

OSVMGASA-2014-0114 No score

Updated otrs package fixes security vulnerability

An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed (CVE-2014-1695).

Record: MGASA-2014-0114
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10073-1 No score

otrs-3.3.16-37.1 on GA media

These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10073-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-1695 No score

Record: UBUNTU-CVE-2014-1695
Updated: 2026-11-02

Affected products

otrs

Affected packages

Affected packages
Package	Affected	Fixed
`otrs2` Debian:11	before 3.3.5-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less 2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6	3.3.5-1
`otrs2` Debian:7	before 3.3.18-1~deb7u1, plus listed versions 3.1.10+dfsg1-13.1.11+dfsg1-13.1.12+dfsg1-13.1.12+dfsg1-23.1.12+dfsg1-3 Show 43 moreShow less 3.1.7+dfsg1-83.1.7+dfsg1-8+deb7u13.1.7+dfsg1-8+deb7u23.1.7+dfsg1-8+deb7u33.1.7+dfsg1-8+deb7u43.1.7+dfsg1-8+deb7u53.1.7+dfsg1-8+deb7u63.1.8+dfsg1-13.1.9+dfsg1-13.2.1+dfsg1-13.2.10-13.2.10-23.2.11-13.2.11-1~bpo70+13.2.12-13.2.2+dfsg1-13.2.3+dfsg1-13.2.4-13.2.5-13.2.6-13.2.6-23.2.7-13.2.7-23.2.8-13.2.9-13.2.9-23.3.1-13.3.10-13.3.11-13.3.2-13.3.3-13.3.3-23.3.3-33.3.4-13.3.5-13.3.6-13.3.7-13.3.7-23.3.8-13.3.9-13.3.9-23.3.9-33.3.9-3~bpo70+1	3.3.18-1~deb7u1
`otrs` Mageia:3	before 3.2.15-1.mga3	3.2.15-1.mga3
`otrs` Mageia:4	before 3.2.15-1.mga4	3.2.15-1.mga4
`otrs` openSUSE:Tumbleweed	before 3.3.14-37.1	3.3.14-37.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	OTRS < 3.1.x / < 3.2.x / < 3.3.x - Persistent Cross-Site Scripting	2015-04-27

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-1695 is a medium vulnerability (CVSS 4.3) in Otrs, published February 28, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.90%, the 92nd percentile. Fixed in otrs2 3.3.5-1.

References

Show 24 moreShow less

This page doesn't list everything

Left out here: 86 versions. The JSON record has them.