- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Patch / fix
- otrs2 Debian 11 6.0.27-1
debian advisories DEBIAN-CVE-2020-1772
- otrs Package Hub 15 SP2 6.0.29-bp152.2.8.1
- otrs Package Hub 15 SP2, Package Hub 15 SP1, openSUSE Leap 15.2 +1 more 6.0.29-bp152.2.5.4
- otrs Package Hub 15 SP1, Package Hub 15, openSUSE Leap 15.1 5.0.42-bp151.3.3.1
opensuse advisories openSUSE-SU-2020:1509-1openSUSE-SU-2020:1475-1openSUSE-SU-2020:0551-1
Is CVE-2020-1772 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.60% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- OTRS AG ((OTRS)) Community Edition
- OTRS AG OTRS
Classification
- Weakness
-
- CWE-155 Improper Neutralization of Wildcards or Matching Symbols
References
-
otrs.com
/release-notes/otrs-security-advisory-2020-09/
patch, vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-04/msg00038.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-09/msg00066.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-09/msg00077.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/05/msg00000.html
mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2023/08/msg00040.html
mailing-list
Sources
- CVE List CVE-2020-1772
- NVD CVE-2020-1772
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.