PT-2020-15050 · Otrs+2 · Otrs+3

Fabian Henneke · Published 2020-03-27 · Updated 2023-08-31 · CVE-2020-1773

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OTRS Community Edition versions 5.0.41 and prior OTRS Community Edition versions 6.0.26 and prior OTRS versions 7.0.15 and prior

Description An attacker with the ability to generate session IDs or password reset tokens may be able to predict other users' session IDs, password reset tokens, and automatically generated passwords. This issue can be exploited by an authenticated user to guess other session IDs, password reset tokens, or automated passwords.

Recommendations For OTRS Community Edition versions 5.0.41 and prior, update to a version later than 5.0.41. For OTRS Community Edition versions 6.0.26 and prior, update to a version later than 6.0.26. For OTRS versions 7.0.15 and prior, update to a version later than 7.0.15.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

ALT-PU-2020-2649

ALT-PU-2020-2748

CVE-2020-1773

DLA-3551-1

OPENSUSE-SU-2020:0551-1

OPENSUSE-SU-2020:1475-1

OPENSUSE-SU-2020:1509-1

OPENSUSE-SU-2020_0551-1

OPENSUSE-SU-2020_1475-1

Affected Products

Alt Linux

Otrs

Otrs Community Edition

Suse

References · 52

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1773 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1773 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1773 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0551-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1509-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3551-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-1773 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1773 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1773 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:1475-1 · Vendor Advisory
• https://otrs.com/release-notes/otrs-security-advisory-2020-10 · Vendor Advisory