« Volver al listado

CVE-2020-1765

Estado: ModificadaMedia (5.3)—

An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Debian — Debian LinuxOpensuse — Backports SLEOpensuse — LeapOtrs — Otrs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-1765",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@otrs.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@otrs.com",
      "affectedData": [
        {
          "vendor": "OTRS AG",
          "product": "((OTRS)) Community Edition",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.x version 5.0.39 and prior versions"
            },
            {
              "status": "affected",
              "version": "6.0.x version 6.0.24 and prior versions"
            }
          ]
        },
        {
          "vendor": "OTRS AG",
          "product": "OTRS",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.x version 7.0.13 and prior versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-10T15:15:11.723",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@otrs.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@otrs.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@otrs.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@otrs.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html",
      "source": "security@otrs.com"
    },
    {
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@otrs.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-01/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@otrs.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-472"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions."
    },
    {
      "lang": "es",
      "value": "Un control inapropiado de los parámetros permite la suplantación de los campos de las siguientes pantallas: AgentTicketCompose, AgentTicketForward, AgentTicketBounce y AgentTicketEmailOutbound. Este problema afecta a: ((OTRS)) Community Edition versiones 5.0.x versión 5.0.39 y anteriores; versiones 6.0.x versión 6.0.24 y anteriores. OTRS versiones 7.0.x versión 7.0.13 y anteriores."
    }
  ],
  "lastModified": "2026-06-17T03:02:21.490",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "930593FF-E99D-46BB-AABD-9562CC94B8D3",
              "versionEndIncluding": "5.0.39",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69D1FDA1-32D6-4793-AB1D-ED9F0A17939F",
              "versionEndIncluding": "6.0.24",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D86D6CD7-52CC-47B5-8075-462D4A3099FC",
              "versionEndIncluding": "7.0.13",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD"
            },
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568"
            },
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@otrs.com"
}