Unscored severity · published Dec 19, 2014
CVE-2014-9324
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OH
Otrs Help Desk · Otrs
3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +25 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9324
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9324
advisories.mageia.org
http://advisories.mageia.org/MGASA-2015-0031.html
secunia.com
http://secunia.com/advisories/59875
secunia.com
http://secunia.com/advisories/62188
secunia.com
http://secunia.com/advisories/62662
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2015:043
Vendor Advisory
https://www.otrs.com/security-advisory-2014-06-incomplete-access-control/
More from Otrs Help Desk
6.5
CVE-2013-2625
An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8