VULNERABILITY INTELLIGENCE
CVE-2020-1772
CVSS score6.5 MEDIUM
EPSS probability1.60%
CISA KEVNot currently listed
Published2020-03-27
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Description
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Weakness classification
- security@otrs.com: CWE-155
- nvd@nist.gov: NVD-CWE-noinfo
Primary references
- security@otrs.com — Mailing List, Third Party Advisory
- security@otrs.com — Mailing List, Third Party Advisory
- security@otrs.com — Mailing List, Third Party Advisory
- security@otrs.com — Mailing List, Third Party Advisory
- security@otrs.com
- security@otrs.com — Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory