PT-2020-12626 · Deskpro · Deskpro

Published 2020-04-01 · Updated 2021-07-21 · CVE-2020-11463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Deskpro versions prior to 2019.8.0

Description An issue was discovered where the "/api/email accounts" endpoint failed to properly validate a user's privilege. This allowed an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. As a result, an attacker could gain full access to all emails sent or received by the system, including password reset emails, making it possible to reset any user's password.

Recommendations For versions prior to 2019.8.0, update to version 2019.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/email accounts" endpoint until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-11463

Affected Products

Deskpro

References · 6

• 🔥 https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro · Exploit
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11463 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11463 · Vendor Advisory
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update · Vendor Advisory
• https://t.me/cvenotify/2345 · Telegram Post