Improper input validation in Otrs

CVE-2014-2554

OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.015 (71.2th percentile) — read the EPSS interpretation.

Affected products

  • Otrs — versions 3.1.0, 3.1.1, 3.1.2
  • Opensuse — versions 12.3, 13.1
  • N/a — versions n/a

Weakness classification (CWE)

References