PT-2020-15055 · Otrs · Otrs

László Gyaraki · Published 2020-11-23 · Updated 2020-12-04 · CVE-2020-1778

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 8.0.9 and prior

Description The issue allows agents to login even if their account is set to invalid when OTRS uses multiple backends for user authentication with LDAP.

Recommendations For versions 8.0.9 and prior, update to a version that contains a fix for this issue to prevent agents from logging in with invalid accounts.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-1778

Affected Products

Otrs

References · 8

• https://ubuntu.com/security/CVE-2020-1778 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1778 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1778 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1778 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2020-16 · Vendor Advisory
• https://t.me/cibsecurity/16704 · Telegram Post
• https://t.me/cvenotify/6551 · Telegram Post