CVE-2014-2554
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to...
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
Exploit likelihood
What each source reports
NVD Score used
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
- Record
CVE-2014-2554- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
- Record
CVE-2014-2554- Updated
- 2026-11-02
EUVDEUVD-2014-2589 No score
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
- Record
EUVD-2014-2589- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3wmp-c58m-j32f No score
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to...
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
- Record
GHSA-3wmp-c58m-j32f- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
- Record
CVE-2014-2554- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2554 No score
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
- Record
DEBIAN-CVE-2014-2554- Updated
- 2026-11-02
OSVMGASA-2014-0194 No score
Updated otrs packages fix multiple vulnerabilities
Updated otrs package fixes security vulnerabilities:
A logged in attacker could insert special content in dynamic fields, leading to JavaScript code being executed in OTRS (CVE-2014-2553).
An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in OTRS (CVE-2014-2554).
- Record
MGASA-2014-0194- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10073-1 No score
otrs-3.3.16-37.1 on GA media
These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10073-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 |
before 3.3.6-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 |
3.3.6-1 |
otrs2Debian:7 From an advisory covering 4 CVEs |
before 3.3.18-1~deb7u1, plus listed versions 3.1.10+dfsg1-13.1.11+dfsg1-13.1.12+dfsg1-13.1.12+dfsg1-23.1.12+dfsg1-3 Show 43 moreShow less3.1.7+dfsg1-83.1.7+dfsg1-8+deb7u13.1.7+dfsg1-8+deb7u23.1.7+dfsg1-8+deb7u33.1.7+dfsg1-8+deb7u43.1.7+dfsg1-8+deb7u53.1.7+dfsg1-8+deb7u63.1.8+dfsg1-13.1.9+dfsg1-13.2.1+dfsg1-13.2.10-13.2.10-23.2.11-13.2.11-1~bpo70+13.2.12-13.2.2+dfsg1-13.2.3+dfsg1-13.2.4-13.2.5-13.2.6-13.2.6-23.2.7-13.2.7-23.2.8-13.2.9-13.2.9-23.3.1-13.3.10-13.3.11-13.3.2-13.3.3-13.3.3-23.3.3-33.3.4-13.3.5-13.3.6-13.3.7-13.3.7-23.3.8-13.3.9-13.3.9-23.3.9-33.3.9-3~bpo70+1 |
3.3.18-1~deb7u1 |
otrsMageia:3 From an advisory covering 2 CVEs |
before 3.2.16-1.mga3 | 3.2.16-1.mga3 |
otrsMageia:4 From an advisory covering 2 CVEs |
before 3.2.16-1.mga4 | 3.2.16-1.mga4 |
otrsopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.3.14-37.1 | 3.3.14-37.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2554 is a medium vulnerability (CVSS 4.3) in Otrs, published April 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in otrs2 3.3.6-1.
References
otrs.com/security-advisory-2014-05-clickjacking-issue
lists.opensuse.org/opensuse-updates/2014-04/msg00062.html
nvd.nist.gov/vuln/detail/CVE-2014-2554
github.com/advisories/GHSA-3wmp-c58m-j32f
security-tracker.debian.org/tracker/CVE-2014-2554
advisories.mageia.org/MGASA-2014-0194.html
Show 17 moreShow less
bugs.mageia.org/show_bug.cgi?id=13252
suse.com/security/cve/CVE-2012-2582
Left out here: 87 versions. The JSON record has them.