CVE-2020-1775 - Vulnerability Details - OpenCVE

BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior versions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Otrs	Otrs

Configuration 1 [-]

OR	cpe:2.3:a:otrs:otrs::::::::
	cpe:2.3:a:otrs:otrs::::::::

No data.

References

Link	Providers
https://otrs.com/release-notes/otrs-security-advisory-2020-12/

History

No history.

MITRE

Status: PUBLISHED

Assigner: OTRS

Published: 2020-06-08T15:29:40.513794Z

Updated: 2024-09-16T22:30:23.236Z

Reserved: 2019-11-29T00:00:00

Link: CVE-2020-1775

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-06-08T16:15:10.197

Modified: 2024-11-21T05:11:21.930

Link: CVE-2020-1775

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "OTRS", "vendor": "OTRS AG", "versions": [{"lessThanOrEqual": "7.0.17", "status": "affected", "version": "7.0.x", "versionType": "custom"}, {"lessThanOrEqual": "8.0.3", "status": "affected", "version": "8.0.x", "versionType": "custom"}]}], "datePublic": "2020-06-08T00:00:00", "descriptions": [{"lang": "en", "value": "BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior versions."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-06-08T15:29:40", "orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8", "shortName": "OTRS"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-12/"}], "solutions": [{"lang": "en", "value": "Upgrade to OTRS 7.0.18 and OTRS 8.0.4."}], "source": {"defect": ["2020050742001441"], "discovery": "USER"}, "title": "Information disclosure in external interface", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@otrs.com", "DATE_PUBLIC": "2020-06-08T00:00:00.000Z", "ID": "CVE-2020-1775", "STATE": "PUBLIC", "TITLE": "Information disclosure in external interface"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "OTRS", "version": {"version_data": [{"version_affected": "<=", "version_name": "7.0.x", "version_value": "7.0.17"}, {"version_affected": "<=", "version_name": "8.0.x", "version_value": "8.0.3"}]}}]}, "vendor_name": "OTRS AG"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior versions."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200 Information Exposure"}]}]}, "references": {"reference_data": [{"name": "https://otrs.com/release-notes/otrs-security-advisory-2020-12/", "refsource": "MISC", "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-12/"}]}, "solution": [{"lang": "en", "value": "Upgrade to OTRS 7.0.18 and OTRS 8.0.4."}], "source": {"defect": ["2020050742001441"], "discovery": "USER"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:46:30.915Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-12/"}]}]}, "cveMetadata": {"assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8", "assignerShortName": "OTRS", "cveId": "CVE-2020-1775", "datePublished": "2020-06-08T15:29:40.513794Z", "dateReserved": "2019-11-29T00:00:00", "dateUpdated": "2024-09-16T22:30:23.236Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*", "matchCriteriaId": "08FF35C3-7B9B-4A24-B043-751903BA6FCD", "versionEndExcluding": "7.0.18", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*", "matchCriteriaId": "8FBBBE40-F0AD-4198-8E66-B4505230FD92", "versionEndExcluding": "8.0.3", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior versions."}, {"lang": "es", "value": "Los destinatarios de BCC en los correos enviados desde OTRS son visibles en los detalles del art\u00edculo en la interfaz externa. Este problema afecta a OTRS: versiones 8.0.3 y anteriores, versiones 7.0.17 y anteriores"}], "id": "CVE-2020-1775", "lastModified": "2024-11-21T05:11:21.930", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security@otrs.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-06-08T16:15:10.197", "references": [{"source": "security@otrs.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-12/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://otrs.com/release-notes/otrs-security-advisory-2020-12/"}], "sourceIdentifier": "security@otrs.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@otrs.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}