PT-2020-12628 · Deskpro · Deskpro

Published 2020-04-01 · Updated 2021-07-21 · CVE-2020-11465

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Deskpro versions prior to 2019.8.0

Description An issue was discovered where the "/api/apps/*" endpoints failed to properly validate a user's privilege. This allows an attacker to control or install helpdesk applications and leak current applications' configurations, including those used as user sources for authentication. As a result, an attacker can forge valid authentication models that resemble any user on the system.

Recommendations For versions prior to 2019.8.0, update to version 2019.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/apps/*" endpoints to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-11465

Affected Products

Deskpro

References · 6

• 🔥 https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro · Exploit
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11465 · Security Note
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update · Vendor Advisory
• https://t.me/cvenotify/2347 · Telegram Post