Vulnerability Database

300,830

Total vulnerabilities in the database

CVE-2020-1772

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

  • Published: Mar 27, 2020
  • Updated: Nov 9, 2025
  • CVE: CVE-2020-1772
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
otrs / otrs 6.0.0 6.0.26.x
otrs / otrs 5.0.0 5.0.41.x
otrs / otrs 7.0.0 7.0.15.x
opensuse / leap 15.1 15.1.x
opensuse / backports_sle 15.0-sp1 15.0-sp1.x
opensuse / backports_sle 15.0 15.0.x
opensuse / leap 15.2 15.2.x
opensuse / backports_sle 15.0-sp2 15.0-sp2.x
debian / debian_linux 8.0 8.0.x