CVE-2014-9324
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before...
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
- Record
CVE-2014-9324- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
- Record
CVE-2014-9324- Updated
- 2026-11-02
EUVDEUVD-2014-9149 No score
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
- Record
EUVD-2014-9149- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p3h2-r83w-vg3r No score
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before...
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
- Record
GHSA-p3h2-r83w-vg3r- Updated
- 2026-11-02
OSV No score
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
- Record
CVE-2014-9324- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9324 No score
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
- Record
DEBIAN-CVE-2014-9324- Updated
- 2026-11-02
OSVMGASA-2015-0031 No score
Updated otrs package fixes CVE-2014-9324
Updated otrs package fixes security vulnerability:
An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured (CVE-2014-9324).
- Record
MGASA-2015-0031- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10073-1 No score
otrs-3.3.16-37.1 on GA media
These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10073-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 |
before 3.3.9-3, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 |
3.3.9-3 |
otrs2Debian:7 |
before 3.1.7+dfsg1-8+deb7u5, plus listed versions 3.1.7+dfsg1-83.1.7+dfsg1-8+deb7u13.1.7+dfsg1-8+deb7u23.1.7+dfsg1-8+deb7u33.1.7+dfsg1-8+deb7u4 |
3.1.7+dfsg1-8+deb7u5 |
otrsMageia:4 |
before 3.2.17-1.mga4 | 3.2.17-1.mga4 |
otrsopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.3.14-37.1 | 3.3.14-37.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9324 is a medium vulnerability (CVSS 6.0) in Otrs Help Desk, published December 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.78%, the 78th percentile. Fixed in otrs2 3.3.9-3.
References
secunia.com/advisories/62188
advisories.mageia.org/MGASA-2015-0031.html
otrs.com/security-advisory-2014-06-incomplete-access-control
mandriva.com/security/advisories?name=MDVSA-2015:043
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-9324
github.com/advisories/GHSA-p3h2-r83w-vg3r
security-tracker.debian.org/tracker/CVE-2014-9324
bugs.mageia.org/show_bug.cgi?id=15024
debian.org/security/2015/dsa-3124
suse.com/security/cve/CVE-2012-2582
Left out here: 94 versions. The JSON record has them.