CVE-2014-1695

OTRS <3.1.20-3.3.5 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.

Exploits (1)

exploitdb WORKING POC

by Adam Ziaja · perlwebappsphp

https://www.exploit-db.com/exploits/36842

View Code ZIP pw:eip

References (8)

[Various Sources] http://adamziaja.com/poc/201401-xss-otrs.html

[Mailing List] http://lists.opensuse.org/opensuse-updates/2014-03/msg00030.html

[Exploit] http://packetstormsecurity.com/files/131654/OTRS-3.x-Cross-Site-Scripting.html

[Vendor Advisory] http://secunia.com/advisories/57018

[Third Party Advisory, VDB Entry] http://www.osvdb.org/103781

[Exploit] https://www.exploit-db.com/exploits/36842/

[Vendor Advisory] https://www.otrs.com/security-advisory-2014-03-xss-issue

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/65844

Scores

EPSS 0.0363

EPSS Percentile 87.7%

Details

CWE

CWE-79

Status published

Products (49)

otrs/otrs

... and 39 more

Published Mar 01, 2014

Tracked Since Feb 18, 2026