CVE-2014-1694: CSRF

Published Feb 4, 2014
·
Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.

Affected Software

45 affected components
OTRS OTRS=3.2.0
OTRS OTRS=3.2.0-beta1
OTRS OTRS=3.2.0-beta2
OTRS OTRS=3.2.0-beta3
OTRS OTRS=3.2.0-beta4
OTRS OTRS=3.2.0-beta5
OTRS OTRS=3.2.0-rc1
OTRS OTRS=3.2.1
OTRS OTRS=3.2.2
OTRS OTRS=3.2.3
OTRS OTRS=3.2.4
OTRS OTRS=3.2.5
OTRS OTRS=3.2.6
OTRS OTRS=3.2.7
OTRS OTRS=3.2.8
OTRS OTRS=3.2.9
OTRS OTRS=3.2.10
OTRS OTRS=3.1.0
OTRS OTRS=3.1.1
OTRS OTRS=3.1.2
OTRS OTRS=3.1.3
OTRS OTRS=3.1.4
OTRS OTRS=3.1.5
OTRS OTRS=3.1.6
OTRS OTRS=3.1.7
OTRS OTRS=3.1.8
OTRS OTRS=3.1.9
OTRS OTRS=3.1.10
OTRS OTRS=3.1.11
OTRS OTRS=3.1.13
OTRS OTRS=3.1.14
OTRS OTRS=3.1.15
OTRS OTRS=3.1.16
OTRS OTRS=3.1.17
OTRS OTRS=3.1.18
OTRS OTRS=3.3.0
OTRS OTRS=3.3.0-beta1
OTRS OTRS=3.3.0-beta2
OTRS OTRS=3.3.0-beta3
OTRS OTRS=3.3.0-beta4
OTRS OTRS=3.3.0-beta5
OTRS OTRS=3.3.0-rc1
OTRS OTRS=3.3.1
OTRS OTRS=3.3.2
OTRS OTRS=3.3.3

Remediation

Patch Available

https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7

Patch Available

https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312

Patch Available

https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77

Patch Available

https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface

Event History

Feb 4, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·09:55 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2014-1694?

CVE-2014-1694 has been classified with a moderate severity rating due to its ability to allow cross-site request forgery (CSRF).

2

How do I fix CVE-2014-1694?

To fix CVE-2014-1694, it is recommended to upgrade Open Ticket Request System (OTRS) to versions 3.1.19, 3.2.14, or 3.3.4 or later where the vulnerabilities have been addressed.

3

What systems are affected by CVE-2014-1694?

CVE-2014-1694 affects OTRS versions 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4.

4

What types of vulnerabilities are associated with CVE-2014-1694?

CVE-2014-1694 is associated with multiple cross-site request forgery (CSRF) vulnerabilities in various components of OTRS.

5

When was CVE-2014-1694 disclosed?

CVE-2014-1694 was disclosed in 2014 as part of an ongoing effort to improve the security of OTRS.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203