CVE-2020-1773: Session / Password / Password token leak

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2020-1773.

Q: What is the severity of CVE-2020-1773?

The severity of CVE-2020-1773 is high with a score of 8.1.

Q: How does CVE-2020-1773 affect ((OTRS)) Community Edition?

CVE-2020-1773 affects ((OTRS)) Community Edition versions 5.0.0 to 5.0.41, versions 6.0.0 to 6.0.26, and versions 7.0.0 to 7.0.15.

Q: What is the impact of CVE-2020-1773?

CVE-2020-1773 allows an attacker to predict other users session IDs, password reset tokens, and automatically generated passwords.

Q: Where can I find more information about CVE-2020-1773?

You can find more information about CVE-2020-1773 at the following references: [http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html), [http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html), [http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html).

Published Mar 27, 2020

Updated

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS; 7.0.15 and prior versions.

Affected Software

3 affected components

OTRS OTRS>=5.0.0<=5.0.41

OTRS OTRS>=6.0.0<=6.0.26

OTRS OTRS>=7.0.0<=7.0.15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OTRS to a version that resolves this vulnerability.
Fixed in 7.0.16
Upgrade
Upgrade OTRS Community Edition 6 to a version that resolves this vulnerability.
Fixed in 6.0.27
Upgrade
Upgrade OTRS Community Edition 5 to a version that resolves this vulnerability.
Fixed in 5.0.42
Upgrade
Upgrade OTRS to a version that resolves this vulnerability.
Patch 4955521af50238046847bce51ad9865950324f77
Upgrade
Upgrade OTRS to a version that resolves this vulnerability.
Patch ab253734bc211541309b9f8ea2b8b70389c4a64e

Event History

Mar 27, 2020

CVE Published

via MITRE·12:47 PM

Data Sourced

via MITRE·12:47 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2020-1773.

What is the severity of CVE-2020-1773?

The severity of CVE-2020-1773 is high with a score of 8.1.

How does CVE-2020-1773 affect ((OTRS)) Community Edition?

CVE-2020-1773 affects ((OTRS)) Community Edition versions 5.0.0 to 5.0.41, versions 6.0.0 to 6.0.26, and versions 7.0.0 to 7.0.15.

What is the impact of CVE-2020-1773?

CVE-2020-1773 allows an attacker to predict other users session IDs, password reset tokens, and automatically generated passwords.

Where can I find more information about CVE-2020-1773?

You can find more information about CVE-2020-1773 at the following references: [http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html), [http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html), [http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html).