CVE-2020-1767 — Otrs vulnerability

5 documents5 sources
Severity
4.3MEDIUMNVD
CNA3.5
EPSS
0.6%
top 31.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
OtrsOtrs AG Community EditionOtrs AG Otrs+1 more
Timeline
PublishedJan 10
Latest updateMay 24

Description

Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: ((OTRS)) Community Edition 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5otrs_ag/community_edition6.0.x version 6.0.24 and prior versions
▶NVDotrs/otrs6.0.0 — 6.0.24+1
▶CVEListV5otrs_ag/otrs7.0.x version 7.0.13 and prior versions

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
GHSA-xqvr-25w4-fgw8: Agent A is able to save a draft (i↗2022-05-24
▶
CVEList
Possible to send drafted messages as wrong agent↗2020-01-10
▶
OSV
CVE-2020-1767: Agent A is able to save a draft (i↗2020-01-10
▶

📋Vendor Advisories

1
Debian
CVE-2020-1767: otrs2 - Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open...↗2020
▶
CVE-2020-1767 — Otrs vulnerability | cvebase