PT-2020-15045 · Otrs · Otrs

Published 2020-02-07 · Updated 2020-02-11 · CVE-2020-1768

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.14 and prior versions.

Description The issue arises from the external frontend system making numerous background calls to the backend, where each background request is treated as user activity. This prevents the SessionMaxIdleTime from being reached.

Recommendations For OTRS versions 7.0.14 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-1768

Affected Products

Otrs

References · 7

• https://cve.org/CVERecord?id=CVE-2020-1768 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2020-04 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1768 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1768 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1768 · Security Note
• https://community.otrs.com/security-advisory-2020-04 · Note