{"id":"CVE-2014-1695","aliases":["DEBIAN-CVE-2014-1695","DLA-1119-1","EUVD-2014-1769","GHSA-wf4h-3v2j-2xw9","MGASA-2014-0114","UBUNTU-CVE-2014-1695","openSUSE-SU-2024:10073-1"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20...","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04895,"percentile":0.92144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2014-02-28T17:00:00Z","modified":"2026-08-27T12:47:35Z","exploits":[{"source":"exploitdb","id":"EDB-36842","title":"OTRS \u003c 3.1.x / \u003c 3.2.x / \u003c 3.3.x - Persistent Cross-Site Scripting","type":"webapps","platform":"php","date":"2015-04-27","url":"https://www.exploit-db.com/exploits/36842"}],"fixes":[{"ecosystem":"Debian:11","package":"otrs2","fixed_in":["3.3.5-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"otrs","fixed_in":["3.2.15-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"otrs","fixed_in":["3.2.15-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-1"}]}],"versions":["2.0.4p01-10","2.0.4p01-11","2.0.4p01-12","2.0.4p01-13","2.0.4p01-14","2.0.4p01-14.1","2.0.4p01-15","2.0.4p01-16","2.0.4p01-17","2.0.4p01-18","2.0.4p01-6","2.0.4p01-7","2.0.4p01-8","2.0.4p01-9","2.0.99beta1-1","2.0.99beta1-2","2.1.1-1","2.1.3-1","2.1.4-1","2.1.4-2","2.1.5-1","2.1.5-2","2.1.5-3","2.1.6-1","2.1.7-1","2.1.7-2","2.2.0~beta2-1","2.2.0~beta3-1","2.2.1-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.5-2","2.2.6-1","2.2.7-1","2.2.7-2","2.2.7-2lenny1","2.2.7-2lenny2","2.2.7-2lenny3","2.2.7-3","2.3.2-1","2.3.2-2","2.3.3-1","2.3.4-1","2.3.4-2","2.3.4-3","2.3.4-4","2.3.4-5","2.3.4-6","2.3.4-7","2.4.10+dfsg1-1","2.4.10+dfsg1-2","2.4.10+dfsg1-3","2.4.5-1","2.4.5-2","2.4.5-3","2.4.5-4","2.4.5-5","2.4.6-1","2.4.6-2","2.4.7+dfsg1-1","2.4.7-1","2.4.7-2","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.8+dfsg1-1","2.4.9+dfsg1-1","2.4.9+dfsg1-2","2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4","2.4.9+dfsg1-3+squeeze5","2.4.9+dfsg1-4","2.4.9+dfsg1-5","3.0.10+dfsg1-1","3.0.10+dfsg1-2","3.0.11+dfsg1-1","3.0.8+dfsg1-1","3.0.9+dfsg1-1","3.1.0~beta4+dfsg1-1","3.1.0~beta5+dfsg1-1","3.1.0~rc1+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.2+dfsg1-1","3.1.2+dfsg1-2","3.1.2+dfsg1-3","3.1.3+dfsg1-1","3.1.3+dfsg1-2","3.1.4+dfsg1-1","3.1.5+dfsg1-1","3.1.5+dfsg1-2","3.1.5+dfsg1-3","3.1.6+dfsg1-1","3.1.7+dfsg1-1","3.1.7+dfsg1-2","3.1.7+dfsg1-3","3.1.7+dfsg1-4","3.1.7+dfsg1-5","3.1.7+dfsg1-6","3.1.7+dfsg1-7","3.1.7+dfsg1-8","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3","3.3.4-1"]},{"source":"osv","ecosystem":"Debian:7","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.18-1~deb7u1"}]}],"versions":["3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.7+dfsg1-8","3.1.7+dfsg1-8+deb7u1","3.1.7+dfsg1-8+deb7u2","3.1.7+dfsg1-8+deb7u3","3.1.7+dfsg1-8+deb7u4","3.1.7+dfsg1-8+deb7u5","3.1.7+dfsg1-8+deb7u6","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.10-1","3.3.11-1","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.7-2","3.3.8-1","3.3.9-1","3.3.9-2","3.3.9-3","3.3.9-3~bpo70+1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-1.mga4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.14-37.1"}]}],"bundled":14}],"products":[{"vendor":"otrs","product":"otrs"}],"references":[{"url":"https://www.exploit-db.com/exploits/36842/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","evidence"]},{"url":"http://www.securityfocus.com/bid/65844","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/57018","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.otrs.com/security-advisory-2014-03-xss-issue","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://packetstormsecurity.com/files/131654/OTRS-3.x-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-03/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://adamziaja.com/poc/201401-xss-otrs.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.osvdb.org/103781","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1695"},{"url":"https://www.exploit-db.com/exploits/36842"},{"url":"https://github.com/advisories/GHSA-wf4h-3v2j-2xw9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-1695","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0114.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12910","tags":["report"]},{"url":"https://www.otrs.com/security-advisory-2014-03-xss-issue/","tags":["advisory"]},{"url":"http://www.otrs.com/release-notes-otrs-help-desk-3-2-15/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-1695","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1695","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9139","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-1695","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","status":"published","published":"2014-02-28T17:00:00Z","modified":"2024-08-06T09:50:10.656Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-1769","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","status":"published","published":"2014-02-28T17:00:00Z","modified":"2024-08-06T09:50:10Z","updated_at":"2026-11-03T01:57:17.345507Z"}],"ghsa":[{"id":"GHSA-wf4h-3v2j-2xw9","title":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20...","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","status":"published","published":"2022-05-17T04:04:46Z","modified":"2025-04-12T12:32:05Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:16.95233Z"}],"nvd":[{"id":"CVE-2014-1695","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","status":"published","published":"2014-03-01T00:01:08.2Z","modified":"2026-06-17T00:05:23.6Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"CVE-2014-1695","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","status":"published","published":"2014-03-01T00:01:08Z","modified":"2026-04-16T06:18:11.357738654Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-1695","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","status":"published","published":"2014-03-01T00:01:08.2Z","modified":"2026-08-27T12:47:35.516841319Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-1119-1","title":"otrs2 - security update","status":"published","published":"2017-09-30T00:00:00Z","modified":"2026-03-09T01:01:29.202469Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2014-0114","title":"Updated otrs package fixes security vulnerability","description":"An attacker could send a specially prepared HTML email to OTRS. If he can\nthen trick an agent into following a special link to display this email,\nJavaScript code would be executed (CVE-2014-1695).\n","status":"published","published":"2014-03-02T20:58:54Z","modified":"2026-04-16T06:24:50.943336728Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10073-1","title":"otrs-3.3.16-37.1 on GA media","description":"These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:45.49578Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-1695","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.","status":"withdrawn","published":"2014-03-01T00:01:00Z","modified":"2025-07-16T07:31:47.859464Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}