Vulnerability-Lookup

CVE-2020-1765 (GCVE-0-2020-1765)

Vulnerability from cvelistv5 – Published: 2020-01-10 15:08 – Updated: 2024-09-16 22:15

Title

Spoofing of From field in several screens

Summary

An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-472 - External Control of Assumed-Immutable Web Parameter

Assigner

OTRS mitre root

References

6 references

URL	Tags
https://otrs.com/release-notes/otrs-security-advi…
https://lists.debian.org/debian-lts-announce/2020…	mailing-list
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Impacted products

2 products

Vendor	Product	Version	CPE status
OTRS AG	((OTRS)) Community Edition	Affected: 5.0.x version 5.0.39 and prior versions Affected: 6.0.x version 6.0.24 and prior versions	guessed
OTRS AG	OTRS	Affected: 7.0.x version 7.0.13 and prior versions	guessed

Date Public

2020-01-10 00:00

Credits

Sebastian Renker, Jonas Becker

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:46:30.988Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/"
          },
          {
            "name": "[debian-lts-announce] 20200129 [SECURITY] [DLA 2079-1] otrs2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html"
          },
          {
            "name": "openSUSE-SU-2020:0551",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html"
          },
          {
            "name": "openSUSE-SU-2020:1475",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html"
          },
          {
            "name": "openSUSE-SU-2020:1509",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html"
          },
          {
            "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "((OTRS)) Community Edition",
          "vendor": "OTRS AG",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.x version 5.0.39 and prior versions"
            },
            {
              "status": "affected",
              "version": "6.0.x version 6.0.24 and prior versions"
            }
          ]
        },
        {
          "product": "OTRS",
          "vendor": "OTRS AG",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.x version 7.0.13 and prior versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sebastian Renker, Jonas Becker"
        }
      ],
      "datePublic": "2020-01-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-472",
              "description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-31T02:06:14.280Z",
        "orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
        "shortName": "OTRS"
      },
      "references": [
        {
          "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/"
        },
        {
          "name": "[debian-lts-announce] 20200129 [SECURITY] [DLA 2079-1] otrs2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html"
        },
        {
          "name": "openSUSE-SU-2020:0551",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html"
        },
        {
          "name": "openSUSE-SU-2020:1475",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html"
        },
        {
          "name": "openSUSE-SU-2020:1509",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html"
        },
        {
          "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to OTRS 7.0.14, ((OTRS)) Community Edition 6.0.25, ((OTRS)) Community Edition 5.0.40"
        },
        {
          "lang": "en",
          "value": "Patch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/d146d4997cbd6e1370669784c6a2ec8d64655252 \nPatch for ((OTRS)) Community Edition 5: https://github.com/OTRS/otrs/commit/874889b86abea4c01ceb1368a836b66694fae1c3"
        }
      ],
      "source": {
        "advisory": "OSA-2020-01",
        "defect": [
          "2019100942003876"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Spoofing of From field in several screens",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
    "assignerShortName": "OTRS",
    "cveId": "CVE-2020-1765",
    "datePublished": "2020-01-10T15:08:55.756Z",
    "dateReserved": "2019-11-29T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:15:10.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-1765",
      "date": "2026-09-14",
      "epss": "0.01452",
      "percentile": "0.71942"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*\", \"versionStartIncluding\": \"5.0.0\", \"versionEndIncluding\": \"5.0.39\", \"matchCriteriaId\": \"930593FF-E99D-46BB-AABD-9562CC94B8D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*\", \"versionStartIncluding\": \"6.0.0\", \"versionEndIncluding\": \"6.0.24\", \"matchCriteriaId\": \"69D1FDA1-32D6-4793-AB1D-ED9F0A17939F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0.0\", \"versionEndIncluding\": \"7.0.13\", \"matchCriteriaId\": \"D86D6CD7-52CC-47B5-8075-462D4A3099FC\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*\", \"matchCriteriaId\": \"40513095-7E6E-46B3-B604-C926F1BA3568\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*\", \"matchCriteriaId\": \"67E82302-4B77-44F3-97B1-24C18AC4A35D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B620311B-34A3-48A6-82DF-6F078D7A4493\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.\"}, {\"lang\": \"es\", \"value\": \"Un control inapropiado de los par\\u00e1metros permite la suplantaci\\u00f3n de los campos de las siguientes pantallas: AgentTicketCompose, AgentTicketForward, AgentTicketBounce y AgentTicketEmailOutbound. Este problema afecta a: ((OTRS)) Community Edition versiones 5.0.x versi\\u00f3n 5.0.39 y anteriores; versiones 6.0.x versi\\u00f3n 6.0.24 y anteriores. OTRS versiones 7.0.x versi\\u00f3n 7.0.13 y anteriores.\"}]",
      "id": "CVE-2020-1765",
      "lastModified": "2024-11-21T05:11:20.417",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@otrs.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N\", \"baseScore\": 3.5, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.1, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:P/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-01-10T15:15:11.723",
      "references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html\", \"source\": \"security@otrs.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html\", \"source\": \"security@otrs.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html\", \"source\": \"security@otrs.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html\", \"source\": \"security@otrs.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"source\": \"security@otrs.com\"}, {\"url\": \"https://otrs.com/release-notes/otrs-security-advisory-2020-01/\", \"source\": \"security@otrs.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://otrs.com/release-notes/otrs-security-advisory-2020-01/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@otrs.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@otrs.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-472\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-1765\",\"sourceIdentifier\":\"security@otrs.com\",\"published\":\"2020-01-10T15:15:11.723\",\"lastModified\":\"2024-11-21T05:11:20.417\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.\"},{\"lang\":\"es\",\"value\":\"Un control inapropiado de los par\u00e1metros permite la suplantaci\u00f3n de los campos de las siguientes pantallas: AgentTicketCompose, AgentTicketForward, AgentTicketBounce y AgentTicketEmailOutbound. Este problema afecta a: ((OTRS)) Community Edition versiones 5.0.x versi\u00f3n 5.0.39 y anteriores; versiones 6.0.x versi\u00f3n 6.0.24 y anteriores. OTRS versiones 7.0.x versi\u00f3n 7.0.13 y anteriores.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@otrs.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":3.5,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@otrs.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-472\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndIncluding\":\"5.0.39\",\"matchCriteriaId\":\"930593FF-E99D-46BB-AABD-9562CC94B8D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndIncluding\":\"6.0.24\",\"matchCriteriaId\":\"69D1FDA1-32D6-4793-AB1D-ED9F0A17939F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndIncluding\":\"7.0.13\",\"matchCriteriaId\":\"D86D6CD7-52CC-47B5-8075-462D4A3099FC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"40513095-7E6E-46B3-B604-C926F1BA3568\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"67E82302-4B77-44F3-97B1-24C18AC4A35D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html\",\"source\":\"security@otrs.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html\",\"source\":\"security@otrs.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html\",\"source\":\"security@otrs.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html\",\"source\":\"security@otrs.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\",\"source\":\"security@otrs.com\"},{\"url\":\"https://otrs.com/release-notes/otrs-security-advisory-2020-01/\",\"source\":\"security@otrs.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://otrs.com/release-notes/otrs-security-advisory-2020-01/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2025-03-15T10:19:47Z",
      "cve": "CVE-2020-1765",
      "id": "CVE-2020-1765",
      "initial_release_date": "2023-02-15T04:04:18Z",
      "product_status:recommended": "15",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-1765",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-1765.json",
      "version": "6"
    }
  }
}

CNVD-2020-16660

Vulnerability from cnvd - Published: 2020-03-11

Title

OTRS输入验证错误漏洞

Description

Open Ticket Request System（OTRS）是德国OTRS集团的一套开源缺陷跟踪管理系统软件。该软件将电话，邮件等各种渠道提交进来的服务请求归类为不同的队列、服务级别，服务人员通过OTRS系统来跟踪和回复客户。 OTRS 7.0.14之前的7.0.x版本、OTRS（社区版）6.0.25之前的6.0.x版本和5.0.40之前的5.0.x版本中存在安全漏洞。攻击者可利用该漏洞伪造AgentTicketCompose、AgentTicketForward和AgentTicketBounce and AgentTicketEmailOutbound页面中的from字段。

Severity

中

Patch Name

OTRS输入验证错误漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://otrs.com/release-notes/otrs-security-advisory-2020-01/

Reference

https://otrs.com/release-notes/otrs-security-advisory-2020-01/

Impacted products

Name
['OTRS OTRS 7.0.，<7.0.14', 'OTRS OTRS（社区版） 6.0.，<6.0.25', 'OTRS OTRS（社区版） 5.0.*，<5.0.40']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-1765"
    }
  },
  "description": "Open Ticket Request System\uff08OTRS\uff09\u662f\u5fb7\u56fdOTRS\u96c6\u56e2\u7684\u4e00\u5957\u5f00\u6e90\u7f3a\u9677\u8ddf\u8e2a\u7ba1\u7406\u7cfb\u7edf\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u5c06\u7535\u8bdd\uff0c\u90ae\u4ef6\u7b49\u5404\u79cd\u6e20\u9053\u63d0\u4ea4\u8fdb\u6765\u7684\u670d\u52a1\u8bf7\u6c42\u5f52\u7c7b\u4e3a\u4e0d\u540c\u7684\u961f\u5217\u3001\u670d\u52a1\u7ea7\u522b\uff0c\u670d\u52a1\u4eba\u5458\u901a\u8fc7OTRS\u7cfb\u7edf\u6765\u8ddf\u8e2a\u548c\u56de\u590d\u5ba2\u6237\u3002\n\nOTRS 7.0.14\u4e4b\u524d\u76847.0.x\u7248\u672c\u3001OTRS\uff08\u793e\u533a\u7248\uff096.0.25\u4e4b\u524d\u76846.0.x\u7248\u672c\u548c5.0.40\u4e4b\u524d\u76845.0.x\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f2a\u9020AgentTicketCompose\u3001AgentTicketForward\u548cAgentTicketBounce and AgentTicketEmailOutbound\u9875\u9762\u4e2d\u7684from\u5b57\u6bb5\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://otrs.com/release-notes/otrs-security-advisory-2020-01/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-16660",
  "openTime": "2020-03-11",
  "patchDescription": "Open Ticket Request System\uff08OTRS\uff09\u662f\u5fb7\u56fdOTRS\u96c6\u56e2\u7684\u4e00\u5957\u5f00\u6e90\u7f3a\u9677\u8ddf\u8e2a\u7ba1\u7406\u7cfb\u7edf\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u5c06\u7535\u8bdd\uff0c\u90ae\u4ef6\u7b49\u5404\u79cd\u6e20\u9053\u63d0\u4ea4\u8fdb\u6765\u7684\u670d\u52a1\u8bf7\u6c42\u5f52\u7c7b\u4e3a\u4e0d\u540c\u7684\u961f\u5217\u3001\u670d\u52a1\u7ea7\u522b\uff0c\u670d\u52a1\u4eba\u5458\u901a\u8fc7OTRS\u7cfb\u7edf\u6765\u8ddf\u8e2a\u548c\u56de\u590d\u5ba2\u6237\u3002\r\n\r\nOTRS 7.0.14\u4e4b\u524d\u76847.0.x\u7248\u672c\u3001OTRS\uff08\u793e\u533a\u7248\uff096.0.25\u4e4b\u524d\u76846.0.x\u7248\u672c\u548c5.0.40\u4e4b\u524d\u76845.0.x\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f2a\u9020AgentTicketCompose\u3001AgentTicketForward\u548cAgentTicketBounce and AgentTicketEmailOutbound\u9875\u9762\u4e2d\u7684from\u5b57\u6bb5\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "OTRS\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "OTRS OTRS 7.0.*\uff0c\u003c7.0.14",
      "OTRS OTRS\uff08\u793e\u533a\u7248\uff09 6.0.*\uff0c\u003c6.0.25",
      "OTRS OTRS\uff08\u793e\u533a\u7248\uff09 5.0.*\uff0c\u003c5.0.40"
    ]
  },
  "referenceLink": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/",
  "serverity": "\u4e2d",
  "submitTime": "2020-01-22",
  "title": "OTRS\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

FKIE_CVE-2020-1765

Vulnerability from fkie_nvd - Published: 2020-01-10 15:15 - Updated: 2026-06-17 03:02

Severity

3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

URL	Tags
security@otrs.com	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html	Mailing List, Third Party Advisory
security@otrs.com	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html	Mailing List, Third Party Advisory
security@otrs.com	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html	Mailing List, Third Party Advisory
security@otrs.com	https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html	Mailing List, Third Party Advisory
security@otrs.com	https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
security@otrs.com	https://otrs.com/release-notes/otrs-security-advisory-2020-01/	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
af854a3a-2127-422b-91ae-364da2661108	https://otrs.com/release-notes/otrs-security-advisory-2020-01/	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
otrs	otrs	*
otrs	otrs	*
otrs	otrs	*
debian	debian_linux	8.0
opensuse	backports_sle	15.0
opensuse	backports_sle	15.0
opensuse	backports_sle	15.0
opensuse	leap	15.1
opensuse	leap	15.2

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "((OTRS)) Community Edition",
          "vendor": "OTRS AG",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.x version 5.0.39 and prior versions"
            },
            {
              "status": "affected",
              "version": "6.0.x version 6.0.24 and prior versions"
            }
          ]
        },
        {
          "product": "OTRS",
          "vendor": "OTRS AG",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.x version 7.0.13 and prior versions"
            }
          ]
        }
      ],
      "source": "security@otrs.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*",
              "matchCriteriaId": "930593FF-E99D-46BB-AABD-9562CC94B8D3",
              "versionEndIncluding": "5.0.39",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*",
              "matchCriteriaId": "69D1FDA1-32D6-4793-AB1D-ED9F0A17939F",
              "versionEndIncluding": "6.0.24",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D86D6CD7-52CC-47B5-8075-462D4A3099FC",
              "versionEndIncluding": "7.0.13",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions."
    },
    {
      "lang": "es",
      "value": "Un control inapropiado de los par\u00e1metros permite la suplantaci\u00f3n de los campos de las siguientes pantallas: AgentTicketCompose, AgentTicketForward, AgentTicketBounce y AgentTicketEmailOutbound. Este problema afecta a: ((OTRS)) Community Edition versiones 5.0.x versi\u00f3n 5.0.39 y anteriores; versiones 6.0.x versi\u00f3n 6.0.24 y anteriores. OTRS versiones 7.0.x versi\u00f3n 7.0.13 y anteriores."
    }
  ],
  "id": "CVE-2020-1765",
  "lastModified": "2026-06-17T03:02:21.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4,
        "source": "security@otrs.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-01-10T15:15:11.723",
  "references": [
    {
      "source": "security@otrs.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html"
    },
    {
      "source": "security@otrs.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html"
    },
    {
      "source": "security@otrs.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html"
    },
    {
      "source": "security@otrs.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html"
    },
    {
      "source": "security@otrs.com",
      "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
    },
    {
      "source": "security@otrs.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/"
    }
  ],
  "sourceIdentifier": "security@otrs.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-472"
        }
      ],
      "source": "security@otrs.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-RFV4-XFV7-5R3P

Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2022-07-26 00:01

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-1765"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-472"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-10T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.",
  "id": "GHSA-rfv4-xfv7-5r3p",
  "modified": "2022-07-26T00:01:11Z",
  "published": "2022-05-24T17:06:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1765"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
    },
    {
      "type": "WEB",
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2020-1765

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-1765

Aliases

CVE-2020-1765

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-1765",
    "description": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.",
    "id": "GSD-2020-1765",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-1765.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-1765"
      ],
      "details": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.",
      "id": "GSD-2020-1765",
      "modified": "2023-12-13T01:21:57.645775Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@otrs.com",
        "DATE_PUBLIC": "2020-01-10T00:00:00.000Z",
        "ID": "CVE-2020-1765",
        "STATE": "PUBLIC",
        "TITLE": "Spoofing of From field in several screens"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "((OTRS)) Community Edition",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "5.0.x version 5.0.39 and prior versions"
                        },
                        {
                          "version_value": "6.0.x version 6.0.24 and prior versions"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "OTRS",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "7.0.x version 7.0.13 and prior versions"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "OTRS AG"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "Sebastian Renker, Jonas Becker"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-472 External Control of Assumed-Immutable Web Parameter"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/",
            "refsource": "CONFIRM",
            "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/"
          },
          {
            "name": "[debian-lts-announce] 20200129 [SECURITY] [DLA 2079-1] otrs2 security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html"
          },
          {
            "name": "openSUSE-SU-2020:0551",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html"
          },
          {
            "name": "openSUSE-SU-2020:1475",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html"
          },
          {
            "name": "openSUSE-SU-2020:1509",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html"
          },
          {
            "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
          }
        ]
      },
      "solution": [
        {
          "lang": "eng",
          "value": "Upgrade to OTRS 7.0.14, ((OTRS)) Community Edition 6.0.25, ((OTRS)) Community Edition 5.0.40 "
        },
        {
          "lang": "eng",
          "value": "Patch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/d146d4997cbd6e1370669784c6a2ec8d64655252 \nPatch for ((OTRS)) Community Edition 5: https://github.com/OTRS/otrs/commit/874889b86abea4c01ceb1368a836b66694fae1c3"
        }
      ],
      "source": {
        "advisory": "OSA-2020-01",
        "defect": [
          "2019100942003876"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.0.13",
                "versionStartIncluding": "7.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.0.24",
                "versionStartIncluding": "6.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.0.39",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@otrs.com",
          "ID": "CVE-2020-1765"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "N/A",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/"
            },
            {
              "name": "[debian-lts-announce] 20200129 [SECURITY] [DLA 2079-1] otrs2 security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html"
            },
            {
              "name": "openSUSE-SU-2020:0551",
              "refsource": "SUSE",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html"
            },
            {
              "name": "openSUSE-SU-2020:1475",
              "refsource": "SUSE",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html"
            },
            {
              "name": "openSUSE-SU-2020:1509",
              "refsource": "SUSE",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html"
            },
            {
              "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-08-31T03:15Z",
      "publishedDate": "2020-01-10T15:15Z"
    }
  }
}

OPENSUSE-SU-2020:0551-1

Vulnerability from csaf_opensuse - Published: 2020-04-25 16:09 - Updated: 2020-04-25 16:09

Summary

Recommended update for otrs

Severity

Moderate

Scope

18 vulnerabilities in this advisory, including CVE-2020-1765.

CVE-2020-1765

3.5 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Recommended: 9 products

Open the full advisory

OPENSUSE-SU-2020:1475-1

Vulnerability from csaf_opensuse - Published: 2020-09-19 22:21 - Updated: 2020-09-19 22:21

Summary

Recommended update for otrs

Severity

Moderate

Scope

18 vulnerabilities in this advisory, including CVE-2020-1765.

CVE-2020-1765

3.5 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Recommended: 12 products

Open the full advisory

OPENSUSE-SU-2020:1509-1

Vulnerability from csaf_opensuse - Published: 2020-09-23 08:23 - Updated: 2020-09-23 08:23

Summary

Recommended update for otrs

Severity

Moderate

Scope

18 vulnerabilities in this advisory, including CVE-2020-1765.

CVE-2020-1765

3.5 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Recommended: 3 products

Open the full advisory

ubuntu-cve-2020-1765

Vulnerability from osv_ubuntu

Published

2020-01-10 15:15

Modified

2025-10-24 04:48

Summary

Details

Severity

3.5 (Low)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2020-1765	REPORT
	https://otrs.com/release-notes/otrs-security-advi…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2020-1765	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "otrs",
            "binary_version": "5.0.7-1"
          },
          {
            "binary_name": "otrs2",
            "binary_version": "5.0.7-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "otrs2",
        "purl": "pkg:deb/ubuntu/otrs2@5.0.7-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.10-1",
        "5.0.1-1",
        "5.0.1-2",
        "5.0.2-1",
        "5.0.3-1",
        "5.0.5-1",
        "5.0.6-1",
        "5.0.7-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "otrs",
            "binary_version": "6.0.5-1"
          },
          {
            "binary_name": "otrs2",
            "binary_version": "6.0.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "otrs2",
        "purl": "pkg:deb/ubuntu/otrs2@6.0.5-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.23-1",
        "5.0.24-1",
        "6.0.1-1",
        "6.0.2-1",
        "6.0.3-1",
        "6.0.4-1",
        "6.0.5-1"
      ]
    }
  ],
  "aliases": [],
  "details": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.",
  "id": "UBUNTU-CVE-2020-1765",
  "modified": "2025-10-24T04:48:15Z",
  "published": "2020-01-10T15:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-1765"
    },
    {
      "type": "REPORT",
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1765"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2020-1765"
  ]
}

WID-SEC-W-2023-2224

Vulnerability from csaf_certbund - Published: 2020-01-13 23:00 - Updated: 2023-08-30 22:00

Summary

OTRS: Mehrere Schwachstellen

Severity

Mittel

Scope

3 vulnerabilities in this advisory, including CVE-2020-1765.

CVE-2020-1765

Es existiert eine Schwachstelle in OTRS, welche auf eine mangelnde Kontrolle von bestimmten Parametern zurückzuführen ist. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um einen Spoofing Angriff durchzuführen und daraus folgend Dateien zu manipulieren. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen eine modifizierte URL oder Webseite in seinem Webbrowser zu öffnen.

Known affected: 1 product Last affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2020-1765 (GCVE-0-2020-1765)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature