Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.

An attacker who is logged into OTRS, a Ticket Request System, as an agent with write permissions for statistics can inject arbitrary code into the system. This can lead to serious problems like privilege escalation, data loss, and denial of service. This issue is also known as CVE-2017-14635 and is resolved by upgrading to the latest upstream release of OTRS3.

****IMPORTANT UPGRADE NOTES**** ===============================

This update requires manual intervention. We strongly recommend to backup all files and databases before upgrading. If you use the MySQL backend you should read Debian bug report #707075 and the included README.Debian file which will provide further information.

If you discover that the maintenance mode is still activated after the update, we recommend to remove /etc/otrs/maintenance.html and /var/lib/otrs/httpd/htdocs/maintenance.html which will resolve the issue .

In addition the following security vulnerabilities were also addressed :

CVE-2014-1695 Cross-site scripting (XSS) vulnerability in OTRS allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email

CVE-2014-2553 Cross-site scripting (XSS) vulnerability in OTRS allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields

CVE-2014-2554 OTRS allows remote attackers to conduct clickjacking attacks via an IFRAME element

For Debian 7 'Wheezy', these problems have been fixed in version 3.3.18-1~deb7u1.

We recommend that you upgrade your otrs2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The OTRS ticket system was updated to 3.1.20 / 3.2.15 :

On openSUSE 12.3 it was updated to 3.1.20: (fix for OSA-2014-03, CVE-2014-1695)

  - Improved HTML filter.

  - 3.1.19 2014-01-28

  - Fixed bug#10158 - Missing quoting in     State::StateGetStatesByType().

  - Fixed bug#10099 - Missing challenge token checks on     customer interface.

  - Fixed bug#8489 - setting Tickets per page resets     AgentTicketQueue.

  - Fixed bug#9661 - Useless code in DynamicField backend.

  - Fixed bug#9622 - Actions in Small ticket overview don't     work when cookies are turned off.

  - Fixed bug#9541 - Package manager cannot use https proxy.

  - Fixed bug#9594 - No auto-reply sent with multiple From     addresses in AgentTicketPhone on PostgreSQL and Oracle.

  - Fixed bug#3434 - Validity of search time frame not     checked by OTRS.

  - Fixed bug#9596 - On merge and bounce screens is     confusing when fill or not 'To', 'Subject' and 'Body'     fields.

  - Fixed bug#9595 - Incomplete page reload handling in     merge and bounce.

  - Fixed bug#3007 - CheckMXRecord and CheckEmailAddresses     have no effect on AgentTicketBounce.

  - Fixed bug#9512 - Database error for invalid date in     AgentTicketSearch.

  - Fixed bug#8835 - No article found for TicketID <TICKET     ID> when showing group tickets

  - Fixed bug#9583 - Dynamic Fields of type Date have     timestamp in notifications.

  - Fixed bug#9579 - SOAP Serializer used in     Kernel/GenericInterface/Transport/ HTTP/SOAP.pm does not     correctly set namespace.

  - Fixed bug#7359 - Setting pending states via generic     agent does not set pending time.

  - Fixed bug#8380 - Middle name not displayed in     AdminCustomerUser.

  - Fixed bug#9576 - GI TicketSearch Date and Date/Time     dynamic fields are ignored.

  - Changed Dynamic Field SearchFieldParameterBuild() API,     LayoutObject is now optional.

  - Fixed bug#9573 - Date and DateTime dynamic fields not     considered in GenericAgent Jobs.

On openSUSE 13.1 it was updated to 3.2.15: (fix for OSA-2014-03, CVE-2014-1695)

  - Improved HTML filter.

  - Fixed bug#10207 - DynamicField Search-Function in     CustomerFrontend is not working.

  - Followup for bug#9011 - New value after value mapping     can't be 0.

  - Fixed bug#10214 - Value '0' for DynamicsFields prevents     TicketCreation.

  - Fixed bug#9616 - Too long activities and transitions are     not displayed correctly.

  - Fixed bug#10212 - My tickets & Company tickets in 3.3.4.

  - Fixed bug#10205 - GenericInterface: Mandatory TimeUnits     can't be 0.

  - Fixed bug#10196 - Ticket merge action does not notify     the owner of the existing ticket.

  - Fixed bug#9692 - On PhoneOutbound articles, the FROM     field shows Customer ID instead Agent ID.

  - Fixed bug#10189 - ProcessManagement: Use article subject     if no ticket title is set.

  - Fixed bug#9654 - TicketUpdate operation doesn't work     when authenticated as a customer.

  - Fixed bug#10137 - Generic interface TicketCreate     operation doesn't work when authenticated as a customer.

  - 3.2.14

  - Fixed bug#10172 - Can't create process tickets with     disabled richtext.

  - Fixed bug#10121 - QQMails break in OTRS.

  - Fixed bug#10158 - Missing quoting in     State::StateGetStatesByType().

  - Fixed bug#8969 - FAQ module Language files installation     fails (Kernel/Language permissions).

  - Fixed bug#9959 - & breaks ExpandCustomerName.

  - Fixed bug#10099 - Missing challenge token checks on     customer interface.

  - Fixed bug#10103 - ArticleTypeID is always undef in     AgentTicketCompose.

  - Added functionality to disable access to tickets of     other customers with the same customer company in     customer interface.

  - Fixed bug#9650 - Special character in customer id breaks     Open Tickets in AgentTicketZoom.

  - Fixed bug#9723 - TicketAccountedTime stat does not run     on Oracle with many tickets

  - Fixed bug#10077 - regular expressions in postmaster     filter return 1 if no regex match.

  - Fixed bug#10070 - Wrong error message if Transition     contains no transition actions.

Updated otrs package fixes security vulnerability :

An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed (CVE-2014-1695).

The OTRS Project reports :

An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed.

ID	Name	Product	Family	Severity
103577	Debian DLA-1119-1 : otrs2 security update	Nessus	Debian Local Security Checks	high
75286	openSUSE Security Update : otrs (openSUSE-SU-2014:0360-1)	Nessus	SuSE Local Security Checks	medium
73001	Mandriva Linux Security Advisory : otrs (MDVSA-2014:054)	Nessus	Mandriva Local Security Checks	medium
72696	FreeBSD : otrs -- XSS Issue (70b72a52-9e54-11e3-babe-60a44c524f57)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-1695

medium

Tenable Plugins

high

medium

medium

medium