CVE-2014-1694
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-1694
Vendor advisory: cve@mitre.org — https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface
Vendor advisory: cve@mitre.org — https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77
Vendor advisory: cve@mitre.org — https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312
Vendor advisory: cve@mitre.org — https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7
Vendor advisory: cve@mitre.org — http://secunia.com/advisories/56655
Vendor advisory: cve@mitre.org — http://secunia.com/advisories/56644
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bullseye | fixed | 3.3.4-1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| otrs | otrs | 3.2.0 | |
| otrs | otrs | 3.2.1 | |
| otrs | otrs | 3.2.2 | |
| otrs | otrs | 3.2.3 | |
| otrs | otrs | 3.2.4 | |
| otrs | otrs | 3.2.5 | |
| otrs | otrs | 3.2.6 | |
| otrs | otrs | 3.2.7 | |
| otrs | otrs | 3.2.8 | |
| otrs | otrs | 3.2.9 | |
| otrs | otrs | 3.2.10 | |
| otrs | otrs | 3.1.0 | |
| otrs | otrs | 3.1.1 | |
| otrs | otrs | 3.1.2 | |
| otrs | otrs | 3.1.3 | |
| otrs | otrs | 3.1.4 | |
| otrs | otrs | 3.1.5 | |
| otrs | otrs | 3.1.6 | |
| otrs | otrs | 3.1.7 | |
| otrs | otrs | 3.1.8 | |
| otrs | otrs | 3.1.9 | |
| otrs | otrs | 3.1.10 | |
| otrs | otrs | 3.1.11 | |
| otrs | otrs | 3.1.13 | |
| otrs | otrs | 3.1.14 | |
| otrs | otrs | 3.1.15 | |
| otrs | otrs | 3.1.16 | |
| otrs | otrs | 3.1.17 | |
| otrs | otrs | 3.1.18 | |
| otrs | otrs | 3.3.0 | |
| otrs | otrs | 3.3.1 | |
| otrs | otrs | 3.3.2 | |
| otrs | otrs | 3.3.3 | |
References
- http://bugs.otrs.org/show_bug.cgi?id=10099
- http://osvdb.org/102632
- http://secunia.com/advisories/56644
- http://secunia.com/advisories/56655
- http://www.debian.org/security/2014/dsa-2867
- http://www.openwall.com/lists/oss-security/2014/01/29/15
- http://www.openwall.com/lists/oss-security/2014/01/29/7
- https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7
- https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312
- https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77
- https://www.otrs.com/release-notes-otrs-help-desk-3-3-4
- https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface
- https://security-tracker.debian.org/tracker/CVE-2014-1694
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.