Session / Password / Password token leak
CVE-2020-1773

7.3HIGH

Key Information:

Vendor

Otrs Ag

Status
((otrs)) Community Edition
Otrs
Vendor
CVE Published:
27 March 2020

What is CVE-2020-1773?

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS; 7.0.15 and prior versions.

Affected Version(s)

((OTRS)) Community Edition 5.0.41 and prior

((OTRS)) Community Edition 6.0.26 and prior

OTRS 7.0.15 and prior

References

https://otrs.com/release-notes/otrs-security-advisory-202...
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisory

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fabian Henneke
.
CVE-2020-1773 : Session / Password / Password token leak