Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2020-1772

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

  • Published: Mar 27, 2020
  • Updated: Apr 13, 2023
  • CVE: CVE-2020-1772
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

No CWE or OWASP classifications available.

Software From Fixed in
otrs / otrs 6.0.0 6.0.26.x
otrs / otrs 5.0.0 5.0.41.x
otrs / otrs 7.0.0 7.0.15.x
opensuse / leap 15.1 15.1.x
opensuse / backports_sle 15.0-sp1 15.0-sp1.x
opensuse / backports_sle 15.0 15.0.x
opensuse / leap 15.2 15.2.x
opensuse / backports_sle 15.0-sp2 15.0-sp2.x
debian / debian_linux 8.0 8.0.x