{"id":"CVE-2014-1694","aliases":["DEBIAN-CVE-2014-1694","DSA-2867-1","EUVD-2014-1768","GHSA-gvjm-c4hq-cvw7","MGASA-2014-0094","UBUNTU-CVE-2014-1694"],"status":"published","title":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2)...","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01479,"percentile":0.74056,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2014-02-04T16:00:00Z","modified":"2026-08-27T12:47:27Z","fixes":[{"ecosystem":"Debian:11","package":"otrs2","fixed_in":["3.3.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-1"}]}],"versions":["2.0.4p01-10","2.0.4p01-11","2.0.4p01-12","2.0.4p01-13","2.0.4p01-14","2.0.4p01-14.1","2.0.4p01-15","2.0.4p01-16","2.0.4p01-17","2.0.4p01-18","2.0.4p01-6","2.0.4p01-7","2.0.4p01-8","2.0.4p01-9","2.0.99beta1-1","2.0.99beta1-2","2.1.1-1","2.1.3-1","2.1.4-1","2.1.4-2","2.1.5-1","2.1.5-2","2.1.5-3","2.1.6-1","2.1.7-1","2.1.7-2","2.2.0~beta2-1","2.2.0~beta3-1","2.2.1-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.5-2","2.2.6-1","2.2.7-1","2.2.7-2","2.2.7-2lenny1","2.2.7-2lenny2","2.2.7-2lenny3","2.2.7-3","2.3.2-1","2.3.2-2","2.3.3-1","2.3.4-1","2.3.4-2","2.3.4-3","2.3.4-4","2.3.4-5","2.3.4-6","2.3.4-7","2.4.10+dfsg1-1","2.4.10+dfsg1-2","2.4.10+dfsg1-3","2.4.5-1","2.4.5-2","2.4.5-3","2.4.5-4","2.4.5-5","2.4.6-1","2.4.6-2","2.4.7+dfsg1-1","2.4.7-1","2.4.7-2","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.8+dfsg1-1","2.4.9+dfsg1-1","2.4.9+dfsg1-2","2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4","2.4.9+dfsg1-3+squeeze5","2.4.9+dfsg1-4","2.4.9+dfsg1-5","3.0.10+dfsg1-1","3.0.10+dfsg1-2","3.0.11+dfsg1-1","3.0.8+dfsg1-1","3.0.9+dfsg1-1","3.1.0~beta4+dfsg1-1","3.1.0~beta5+dfsg1-1","3.1.0~rc1+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.2+dfsg1-1","3.1.2+dfsg1-2","3.1.2+dfsg1-3","3.1.3+dfsg1-1","3.1.3+dfsg1-2","3.1.4+dfsg1-1","3.1.5+dfsg1-1","3.1.5+dfsg1-2","3.1.5+dfsg1-3","3.1.6+dfsg1-1","3.1.7+dfsg1-1","3.1.7+dfsg1-2","3.1.7+dfsg1-3","3.1.7+dfsg1-4","3.1.7+dfsg1-5","3.1.7+dfsg1-6","3.1.7+dfsg1-7","3.1.7+dfsg1-8","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3"]},{"source":"osv","ecosystem":"Debian:6.0","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9+dfsg1-3+squeeze5"}]}],"versions":["2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7+dfsg1-8+deb7u4"}]}],"versions":["3.1.7+dfsg1-8","3.1.7+dfsg1-8+deb7u1","3.1.7+dfsg1-8+deb7u2","3.1.7+dfsg1-8+deb7u3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.14-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.14-1.mga4"}]}],"bundled":2}],"products":[{"vendor":"otrs","product":"otrs"}],"references":[{"url":"http://osvdb.org/102632","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/29/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.otrs.com/release-notes-otrs-help-desk-3-3-4","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://secunia.com/advisories/56655","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/29/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://secunia.com/advisories/56644","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2867","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://bugs.otrs.org/show_bug.cgi?id=10099","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1694"},{"url":"https://github.com/advisories/GHSA-gvjm-c4hq-cvw7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-1694","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0094.html","tags":["advisory"]},{"url":"http://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/","tags":["advisory"]},{"url":"http://www.otrs.com/security-advisory-2014-02-sql-injection-issue/","tags":["advisory"]},{"url":"http://www.otrs.com/release_notes_otrs_help_desk_3_2_14/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10669","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1694","tags":["report"]},{"url":"https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/29","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1694","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-1694","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","status":"published","published":"2014-02-04T16:00:00Z","modified":"2024-08-06T09:50:10.552Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-1768","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","status":"published","published":"2014-02-04T16:00:00Z","modified":"2024-08-06T09:50:10Z","updated_at":"2026-11-03T01:57:17.345507Z"}],"ghsa":[{"id":"GHSA-gvjm-c4hq-cvw7","title":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2)...","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","status":"published","published":"2022-05-17T04:50:42Z","modified":"2023-01-28T05:02:46Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:43:50.688054Z"}],"nvd":[{"id":"CVE-2014-1694","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","status":"published","published":"2014-02-04T21:55:05.64Z","modified":"2026-06-17T00:05:23.447Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"CVE-2014-1694","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","status":"published","published":"2014-02-04T21:55:05Z","modified":"2026-04-16T06:24:10.248362088Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-1694","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","status":"published","published":"2014-02-04T21:55:05.64Z","modified":"2026-08-27T12:47:27.621750827Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2867-1","title":"otrs2 - several","status":"published","published":"2014-02-23T00:00:00Z","modified":"2026-03-09T01:20:36.975189Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0094","title":"Updated otrs packages fix security vulnerabilities and a missing dependency","description":"Updated otrs package fixes security vulnerabilities:\n\nIn OTRS before 3.2.14, an attacker that managed to take over the session of a\nlogged in customer could create tickets and/or send follow-ups to existing\ntickets due to missing challenge token checks (CVE-2014-1694).\n\nIn OTRS before 3.2.14, an attacker with a valid customer or agent login could\ninject SQL in the ticket search URL (CVE-2014-1471).\n\nThe update also adds a missing dependency which prevented database creation\nduring web based installation.\n","status":"published","published":"2014-02-25T21:22:39Z","modified":"2026-04-16T06:23:42.949920786Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-1694","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.","status":"withdrawn","published":"2014-02-04T21:55:00Z","modified":"2025-07-16T07:31:47.794575Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}