Design/Logic Flaw

Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: OTRS Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions...

Design/Logic Flaw

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...

CVE-2020-1772

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Tokens, generated by users which already requested new passwords. This issue affects: OTRS Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15...

CVE-2020-1770

Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: OTRS Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions...

CVE-2020-1770

CVE-2020-1770 is an information-disclosure issue in the OTRS/Open Source Ticket Request System where generated support bundle files could contain sensitive data. Public advisories list affected products as OTRS Community Edition 5.0.41 and earlier, 6.0.26 and earlier, and OTRS 7.0.15 and earlier,...

CVE-2020-1770 Information disclosure in support bundle files

Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: OTRS Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions...

CVE-2020-1771 Possible XSS in Customer user address book

Attacker is able craft an article with a link to the customer address book with malicious content JavaScript. When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: OTRS Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior...

CVE-2020-1769 Autocomplete in the form login screens

In the login screens in agent and customer interface, Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: OTRS Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions...

CVE-2020-1769

CVE-2020-1769 affects OTRS/Open-Source Ticket Request System where the login screens autocomplete username/password fields. Root cause: autocomplete enabled in login inputs, allowing potential credential exposure. The fix adds a configuration setting (DisableLoginAutocomplete) to disable autocomp...

CVE-2020-1771

Removed by vendor...

CVE-2020-1773

Removed by vendor...

CVE-2020-1770

Removed by vendor...

CVE-2020-1773

CVE-2020-1773 affects OTRS Open-Source Ticket Request System. Affected: OTRS Community Edition ≤ 5.0.41, ≤ 6.0.26, ≤ 7.0.15 and earlier (with later versions also implicated by downstream advisories). Description from multiple sources confirms that an attacker who can generate session IDs or passw...

CVE-2020-1773 Session / Password / Password token leak

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...

CVE-2020-1769

Removed by vendor...

CVE-2020-1772

CVE-2020-1772 affects OTRS/Open Source Ticket Request System. An attacker can craft Lost Password requests with wildcards in the Token value to retrieve valid tokens generated for users who requested password resets, impacting versions: OTRS Community Edition 5.0.41 and earlier, 6.0.26 and earlie...

CVE-2020-1772

Removed by vendor...

CVE-2020-1772 Information Disclosure

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Tokens, generated by users which already requested new passwords. This issue affects: OTRS Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15...

CVE-2020-1771

CVE-2020-1771 affects OTRS Community Edition up to 6.0.26 and OTRS up to 7.0.15. An attacker can craft an article with a link to the customer address book containing malicious JavaScript; when opened, the missing parameter encoding allows JavaScript execution (XSS-like). Public disclosures and pa...

PT-2020-15050 · Otrs +2 · Otrs +3

Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 5.0.41 and prior OTRS Community Edition versions 6.0.26 and prior OTRS versions 7.0.15 and prior Description: An attacker with the ability to generate session IDs or password reset tokens may be able to predict...