CVE-2020-1772

Опубликовано: 27 мар. 2020

Источник: nvd

CVSS3: 6.5

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
https://otrs.com/release-notes/otrs-security-advisory-2020-09/
Patch
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
https://otrs.com/release-notes/otrs-security-advisory-2020-09/
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*

Версия от 5.0.0 (включая) до 5.0.41 (включая)

cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*

Версия от 6.0.0 (включая) до 6.0.26 (включая)

cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.0.15 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*

cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 69%

0.00587

Низкий

6.5 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-155

NVD-CWE-noinfo

Связанные уязвимости

CVE-2020-1772

CVSS3: 6.5

ubuntu

почти 6 лет назад

CVE-2020-1772

CVSS3: 6.5

debian

почти 6 лет назад

It's possible to craft Lost Password requests with wildcards in the To ...

GHSA-59rf-fq39-rh6x

CVSS3: 7.5

github

больше 3 лет назад

openSUSE-SU-2020:1475-1

suse-cvrf

больше 5 лет назад

Recommended update for otrs

openSUSE-SU-2020:0551-1

suse-cvrf

почти 6 лет назад

Recommended update for otrs

EPSS

Процентиль: 69%

0.00587

Низкий

6.5 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-155

NVD-CWE-noinfo