CVE-2020-1776

Published: Jul 20, 2020Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions.

Affected (3)

Products: Otrs: Otrs

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Otrs Otrs	From 7.0.0 to 7.0.19
Otrs Otrs	From 8.0.1 to 8.0.5
Otrs Otrs	Before 6.0.29

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Source: security@otrs.com

https://otrs.com/release-notes/otrs-security-advisory-2020-13/

Source: security@otrs.com

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://otrs.com/release-notes/otrs-security-advisory-2020-13/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.