CVE-2014-1695

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.90% chance of exploitation in the next 30 days, 92nd percentile

Published

2014-02-28

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://adamziaja.com/poc/201401-xss-otrs.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/36842

Security advisories

• http://secunia.com/advisories/57018
• https://www.otrs.com/security-advisory-2014-03-xss-issue
• http://www.securityfocus.com/bid/65844

References

• CVE Record
• NVD entry