Description
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | otrs2 | 3.3.4-1 | — |
| Debian 7 | otrs2 | 3.1.7+dfsg1-8+deb7u4 | DSA-2867-1 |
| Debian 6.0 | otrs2 | 2.4.9+dfsg1-3+squeeze5 | DSA-2867-1 |
Advisories 1
- DSA-2867-1 otrs2 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 102632 vdb-entry
- https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface
- https://github.com/OTRS/otrs/commit/6f324aaf8647729d509eebf063a0181f9f9196f7
- [oss-security] 20140129 Re: CVE Request: otrs: CSRF issue in customer web interface mailing-list
- https://www.otrs.com/release-notes-otrs-help-desk-3-3-4
- https://github.com/OTRS/otrs/commit/92f417277f43832f1a0462f2485fe1fd3fd52312
- 56655 third-party-advisory
- [oss-security] 20140129 CVE Request: otrs: CSRF issue in customer web interface mailing-list
- https://github.com/OTRS/otrs/commit/ca2c3390fd60d9a3f810ed2c22cbc2c193457b77
- 56644 third-party-advisory
- DSA-2867 vendor-advisory
- http://bugs.otrs.org/show_bug.cgi?id=10099