PT-2020-12627 · Deskpro · Deskpro

Published 2020-04-01 · Updated 2021-07-21 · CVE-2020-11464

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Deskpro versions prior to 2019.8.0

Description An issue was discovered where the "/api/people" endpoint failed to properly validate a user's privilege. This allowed an attacker to retrieve sensitive information about all users registered on the system, including their full name, privilege, email address, phone number, etc.

Recommendations For versions prior to 2019.8.0, update to version 2019.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/people" endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-11464

Affected Products

Deskpro

References · 6

• 🔥 https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro · Exploit
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11464 · Security Note
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update · Vendor Advisory
• https://t.me/cvenotify/2346 · Telegram Post