Vulnerability · Published Mar 27, 2020 · Assigned by OTRS
CVE-2020-1769Autocomplete in the form login screens
Low 3.5
In plain English
A low-severity security flaw in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)1.2%top 31.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | ((OTRS)) Community Edition | 5.0.x – through 5.0.416.0.x – through 6.0.26 |
| OTRS AG | OTRS | 7.0.x – through 7.0.15 |
Weakness: CWE-16 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
- https://otrs.com/release-notes/otrs-security-advisory-2020-06/
- openSUSE-SU-2020:0551 vendor-advisory
- openSUSE-SU-2020:1475 vendor-advisory
- openSUSE-SU-2020:1509 vendor-advisory
- [debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update mailing-list