ByteOS Network

Source-cve@mitre.org

Published At-04 Feb, 2014 | 21:55

Updated At-11 Apr, 2025 | 00:51

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

Hyperlink	Source	Resource
http://bugs.otrs.org/show_bug.cgi?id=10099	cve@mitre.org	N/A
http://osvdb.org/102632	cve@mitre.org	N/A
http://secunia.com/advisories/56644	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/56655	cve@mitre.org	Vendor Advisory
http://www.debian.org/security/2014/dsa-2867	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2014/01/29/15	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2014/01/29/7	cve@mitre.org	N/A
https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7	cve@mitre.org	Exploit Patch
https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312	cve@mitre.org	Exploit Patch
https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77	cve@mitre.org	Exploit Patch
https://www.otrs.com/release-notes-otrs-help-desk-3-3-4	cve@mitre.org	N/A
https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface	cve@mitre.org	Patch Vendor Advisory
http://bugs.otrs.org/show_bug.cgi?id=10099	af854a3a-2127-422b-91ae-364da2661108	N/A
http://osvdb.org/102632	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/56644	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/56655	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://www.debian.org/security/2014/dsa-2867	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.openwall.com/lists/oss-security/2014/01/29/15	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.openwall.com/lists/oss-security/2014/01/29/7	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
https://www.otrs.com/release-notes-otrs-help-desk-3-3-4	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History