CVE-2020-11464

Description

An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive information about all users registered on the system. This includes their full name, privilege, email address, phone number, etc.

Weakness classification

• nvd@nist.gov: CWE-269

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory