CVE-2020-1772

Description

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

References

https://otrs.com/release-notes/otrs-security-advisory-2020-09/

https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3