CVE-2020-1779: Dynamic templates reveal sensitive data when OTRS tags are used
When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2020-1779?
CVE-2020-1779 is a vulnerability that allows admin to use OTRS tags which are not masked properly, revealing sensitive information in dynamic templates (OTRSTicketForms).
Which software versions are affected by CVE-2020-1779?
The OTRS AG OTRSTicketForms versions 6.0.0 to 6.0.40, 7.0.0 to 7.0.29, and 8.0.0 to 8.0.3 are affected by CVE-2020-1779.
What is the severity of CVE-2020-1779?
CVE-2020-1779 has a severity level of medium (4.9).
How can the vulnerability CVE-2020-1779 be exploited?
The vulnerability CVE-2020-1779 can be exploited by an admin using OTRS tags that are not properly masked in dynamic templates, leading to the disclosure of sensitive information.
Is there a fix available for CVE-2020-1779?
Yes, to fix CVE-2020-1779, update to the latest version of OTRS AG OTRSTicketForms (6.0.41 or higher for version 6.0.x, 7.0.30 or higher for version 7.0.x, and 8.0.4 or higher for version 8.0.x) as mentioned in the OTRS Security Advisory: https://otrs.com/release-notes/otrs-security-advisory-2020-17/.