CVE-2020-1772: Information Disclosure
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 7.0.16 - Upgrade
Upgrade
OTRS Community Edition 6to a version that resolves this vulnerability.Fixed in 6.0.27 - Upgrade
Upgrade
OTRS Community Edition 5to a version that resolves this vulnerability.Fixed in 5.0.42
Event History
Frequently Asked Questions
What is CVE-2020-1772?
CVE-2020-1772 is a vulnerability that allows attackers to retrieve valid Tokens used for Lost Password requests in ((OTRS)) Community Edition versions 5.0.41 and prior, 6.0.26 and prior, and 7.0.15 and prior.
What is the severity of CVE-2020-1772?
CVE-2020-1772 has a severity rating of 7.5 (High).
Which software versions are affected by CVE-2020-1772?
The affected software versions include ((OTRS)) Community Edition 5.0.41 and prior, 6.0.26 and prior, and 7.0.15 and prior.
How can an attacker exploit CVE-2020-1772?
An attacker can exploit CVE-2020-1772 by crafting Lost Password requests with wildcards in the Token value to retrieve valid Tokens generated by other users.
Are there any fixes available for CVE-2020-1772?
Yes, fixes for CVE-2020-1772 have been released. It is recommended to update ((OTRS)) Community Edition to a version that is not affected.