{"id":"CVE-2014-2553","aliases":["DEBIAN-CVE-2014-2553","DLA-1119-1","EUVD-2014-2588","GHSA-xw7v-pcmp-g44q","MGASA-2014-0194","openSUSE-SU-2024:10073-1"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21...","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01449,"percentile":0.73493,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-04-02T14:00:00Z","modified":"2026-08-27T12:47:31Z","fixes":[{"ecosystem":"Debian:11","package":"otrs2","fixed_in":["3.3.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.6-1"}]}],"versions":["2.0.4p01-10","2.0.4p01-11","2.0.4p01-12","2.0.4p01-13","2.0.4p01-14","2.0.4p01-14.1","2.0.4p01-15","2.0.4p01-16","2.0.4p01-17","2.0.4p01-18","2.0.4p01-6","2.0.4p01-7","2.0.4p01-8","2.0.4p01-9","2.0.99beta1-1","2.0.99beta1-2","2.1.1-1","2.1.3-1","2.1.4-1","2.1.4-2","2.1.5-1","2.1.5-2","2.1.5-3","2.1.6-1","2.1.7-1","2.1.7-2","2.2.0~beta2-1","2.2.0~beta3-1","2.2.1-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.5-2","2.2.6-1","2.2.7-1","2.2.7-2","2.2.7-2lenny1","2.2.7-2lenny2","2.2.7-2lenny3","2.2.7-3","2.3.2-1","2.3.2-2","2.3.3-1","2.3.4-1","2.3.4-2","2.3.4-3","2.3.4-4","2.3.4-5","2.3.4-6","2.3.4-7","2.4.10+dfsg1-1","2.4.10+dfsg1-2","2.4.10+dfsg1-3","2.4.5-1","2.4.5-2","2.4.5-3","2.4.5-4","2.4.5-5","2.4.6-1","2.4.6-2","2.4.7+dfsg1-1","2.4.7-1","2.4.7-2","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.8+dfsg1-1","2.4.9+dfsg1-1","2.4.9+dfsg1-2","2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4","2.4.9+dfsg1-3+squeeze5","2.4.9+dfsg1-4","2.4.9+dfsg1-5","3.0.10+dfsg1-1","3.0.10+dfsg1-2","3.0.11+dfsg1-1","3.0.8+dfsg1-1","3.0.9+dfsg1-1","3.1.0~beta4+dfsg1-1","3.1.0~beta5+dfsg1-1","3.1.0~rc1+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.2+dfsg1-1","3.1.2+dfsg1-2","3.1.2+dfsg1-3","3.1.3+dfsg1-1","3.1.3+dfsg1-2","3.1.4+dfsg1-1","3.1.5+dfsg1-1","3.1.5+dfsg1-2","3.1.5+dfsg1-3","3.1.6+dfsg1-1","3.1.7+dfsg1-1","3.1.7+dfsg1-2","3.1.7+dfsg1-3","3.1.7+dfsg1-4","3.1.7+dfsg1-5","3.1.7+dfsg1-6","3.1.7+dfsg1-7","3.1.7+dfsg1-8","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3","3.3.4-1","3.3.5-1"]},{"source":"osv","ecosystem":"Debian:7","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.18-1~deb7u1"}]}],"versions":["3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.7+dfsg1-8","3.1.7+dfsg1-8+deb7u1","3.1.7+dfsg1-8+deb7u2","3.1.7+dfsg1-8+deb7u3","3.1.7+dfsg1-8+deb7u4","3.1.7+dfsg1-8+deb7u5","3.1.7+dfsg1-8+deb7u6","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.10-1","3.3.11-1","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.7-2","3.3.8-1","3.3.9-1","3.3.9-2","3.3.9-3","3.3.9-3~bpo70+1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.16-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.16-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.14-37.1"}]}],"bundled":14}],"products":[{"vendor":"otrs","product":"otrs"}],"references":[{"url":"http://secunia.com/advisories/57616","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.otrs.com/security-advisory-2014-04-xss-issue","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2553"},{"url":"https://github.com/advisories/GHSA-xw7v-pcmp-g44q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2553","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0194.html","tags":["advisory"]},{"url":"https://www.otrs.com/security-advisory-2014-04-xss-issue/","tags":["advisory"]},{"url":"https://www.otrs.com/security-advisory-2014-05-clickjacking-issue/","tags":["advisory"]},{"url":"https://www.otrs.com/release-notes-otrs-help-desk-3-2-16/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13252","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9139","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-2553","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.","status":"published","published":"2014-04-02T14:00:00Z","modified":"2024-08-06T10:21:35.697Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-2588","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.","status":"published","published":"2014-04-02T14:00:00Z","modified":"2024-08-06T10:21:35Z","updated_at":"2026-11-03T01:57:14.00634Z"}],"ghsa":[{"id":"GHSA-xw7v-pcmp-g44q","title":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21...","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.","status":"published","published":"2022-05-17T04:44:52Z","modified":"2023-01-28T05:02:20Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:45.797636Z"}],"nvd":[{"id":"CVE-2014-2553","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.","status":"published","published":"2014-04-02T16:05:57.207Z","modified":"2026-06-17T00:06:48.107Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"CVE-2014-2553","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.","status":"published","published":"2014-04-02T16:05:57Z","modified":"2026-04-16T06:18:04.740606825Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2553","description":"Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.","status":"published","published":"2014-04-02T16:05:57.207Z","modified":"2026-08-27T12:47:31.483946885Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-1119-1","title":"otrs2 - security update","status":"published","published":"2017-09-30T00:00:00Z","modified":"2026-03-09T01:01:29.202469Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2014-0194","title":"Updated otrs packages fix multiple vulnerabilities","description":"Updated otrs package fixes security vulnerabilities:\n\nA logged in attacker could insert special content in dynamic fields, leading\nto JavaScript code being executed in OTRS (CVE-2014-2553).\n\nAn attacker could embed OTRS in a hidden iframe tag of another page,\ntricking the user into clicking links in OTRS (CVE-2014-2554).\n","status":"published","published":"2014-04-24T19:11:34Z","modified":"2026-04-16T06:22:48.308220492Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10073-1","title":"otrs-3.3.16-37.1 on GA media","description":"These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:45.49578Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}