CVE-2014-2553

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21...

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.

Exploit likelihood

1.45%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Record: CVE-2014-2553
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-2553
Updated: 2026-11-02

EUVDEUVD-2014-2588 No score

Record: EUVD-2014-2588
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xw7v-pcmp-g44q No score

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21...

Record: GHSA-xw7v-pcmp-g44q
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2014-2553
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-2553 No score

Record: DEBIAN-CVE-2014-2553
Updated: 2026-11-02

OSVMGASA-2014-0194 No score

Updated otrs packages fix multiple vulnerabilities

Updated otrs package fixes security vulnerabilities:

A logged in attacker could insert special content in dynamic fields, leading to JavaScript code being executed in OTRS (CVE-2014-2553).

An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in OTRS (CVE-2014-2554).

Record: MGASA-2014-0194
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10073-1 No score

otrs-3.3.16-37.1 on GA media

These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10073-1
Updated: 2026-11-02

Affected products

otrs

Affected packages

Affected packages
Package	Affected	Fixed
`otrs2` Debian:11	before 3.3.6-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less 2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6	3.3.6-1
`otrs2` Debian:7 From an advisory covering 4 CVEs	before 3.3.18-1~deb7u1, plus listed versions 3.1.10+dfsg1-13.1.11+dfsg1-13.1.12+dfsg1-13.1.12+dfsg1-23.1.12+dfsg1-3 Show 43 moreShow less 3.1.7+dfsg1-83.1.7+dfsg1-8+deb7u13.1.7+dfsg1-8+deb7u23.1.7+dfsg1-8+deb7u33.1.7+dfsg1-8+deb7u43.1.7+dfsg1-8+deb7u53.1.7+dfsg1-8+deb7u63.1.8+dfsg1-13.1.9+dfsg1-13.2.1+dfsg1-13.2.10-13.2.10-23.2.11-13.2.11-1~bpo70+13.2.12-13.2.2+dfsg1-13.2.3+dfsg1-13.2.4-13.2.5-13.2.6-13.2.6-23.2.7-13.2.7-23.2.8-13.2.9-13.2.9-23.3.1-13.3.10-13.3.11-13.3.2-13.3.3-13.3.3-23.3.3-33.3.4-13.3.5-13.3.6-13.3.7-13.3.7-23.3.8-13.3.9-13.3.9-23.3.9-33.3.9-3~bpo70+1	3.3.18-1~deb7u1
`otrs` Mageia:3 From an advisory covering 2 CVEs	before 3.2.16-1.mga3	3.2.16-1.mga3
`otrs` Mageia:4 From an advisory covering 2 CVEs	before 3.2.16-1.mga4	3.2.16-1.mga4
`otrs` openSUSE:Tumbleweed From an advisory covering 14 CVEs	before 3.3.14-37.1	3.3.14-37.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2553 is a low vulnerability (CVSS 3.5) in Otrs, published April 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in otrs2 3.3.6-1.

References

Show 18 moreShow less

This page doesn't list everything

Left out here: 87 versions. The JSON record has them.