CVE-2014-1695

Upstream information

CVE-2014-1695 at MITRE

Description

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.

---

SUSE information

CVSS v2 Scores

	National Vulnerability Database
Base Score	4.30
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

SUSE Bugzilla entry: 866476 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2014:0360-1, published Thu, 13 Mar 2014 10:04:13 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE 12.3	otrs >= 3.1.20-26.9.1 otrs-doc >= 3.1.20-26.9.1 otrs-itsm >= 3.1.10-26.9.1	Patchnames: openSUSE-2014-202
openSUSE 13.1	otrs >= 3.2.15-31.5.1 otrs-doc >= 3.2.15-31.5.1 otrs-itsm >= 3.2.9-31.5.1	Patchnames: openSUSE-2014-202