CVE-2020-1769
published 2020-03-27CVE-2020-1769: In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
1.25%
66.1th percentile
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | otrs2 | < otrs2 6.0.27-1 (bullseye) | otrs2 6.0.27-1 (bullseye) |
| opensuse | backports_sle | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| otrs | otrs | 5.0.0 – 5.0.41 | — |
| otrs | otrs | 6.0.0 – 6.0.26 | — |
| otrs | otrs | 7.0.0 – 7.0.15 | — |
| otrs_ag | community_edition | 5.0.x – 5.0.41 | — |
| otrs_ag | community_edition | 6.0.x – 6.0.26 | — |
| otrs_ag | otrs | 7.0.x – 7.0.15 | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv4.3MEDIUM
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2020-1769: otrs2 - In the login screens (in agent and customer interface), Username and Password fi...
vendor_debian·2020·CVSS 3.5
CVE-2020-1769 [LOW] CVE-2020-1769: otrs2 - In the login screens (in agent and customer interface), Username and Password fi...
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Scope: local
bullseye: resolved (fixed in 6.0.27-1)
GHSA
GHSA-xfh6-pvv6-h7qg: In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue
ghsa_unreviewed·2022-05-24
CVE-2020-1769 [MEDIUM] GHSA-xfh6-pvv6-h7qg: In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
OSV
CVE-2020-1769: In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue
osv·2020-03-27·CVSS 4.3
CVE-2020-1769 [MEDIUM] CVE-2020-1769: In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlhttps://otrs.com/release-notes/otrs-security-advisory-2020-06/http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlhttps://otrs.com/release-notes/otrs-security-advisory-2020-06/
2020-03-27
Published