VulnerabilityModified

CVE-2020-1779

When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information.

MEDIUM 4.9EPSS 1.00%

Does this matter?

Lower severity and a low EPSS score (1.00%). Track it; it rarely justifies an emergency change on its own.

Description

When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions.

CVSS 3.1: 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.00% probability · 61th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: otrs/ticket forms
Source: security@otrs.com

References

https://otrs.com/release-notes/otrs-security-advisory-2020-17/Broken Link
https://otrs.com/release-notes/otrs-security-advisory-2020-17/Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.