Search
Find a vulnerability
Search criteria
2 vulnerabilities found for ticket_forms by otrs
CVE-2020-1779 (GCVE-0-2020-1779)
Vulnerability from nvd – Published: 2021-02-08 10:55 – Updated: 2024-09-16 17:15
VLAI
EPSS
VEX
Title
Dynamic templates reveal sensitive data when OTRS tags are used
Summary
When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions.
Severity
4.3 (Medium)
CWE
- CWE-200 - Information Exposure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://otrs.com/release-notes/otrs-security-advi… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OTRS AG | OTRSTicketForms |
Affected:
6.0.x , ≤ 6.0.40
(custom)
Affected: 7.0.x , ≤ 7.0.29 (custom) Affected: 8.0.x , ≤ 8.0.3 (custom) |
Date Public
2021-02-08 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:46:30.959Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OTRSTicketForms",
"vendor": "OTRS AG",
"versions": [
{
"lessThanOrEqual": "6.0.40",
"status": "affected",
"version": "6.0.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.0.29",
"status": "affected",
"version": "7.0.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.3",
"status": "affected",
"version": "8.0.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "L\u00e1szl\u00f3 Gyaraki"
}
],
"datePublic": "2021-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-08T10:55:18.000Z",
"orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
"shortName": "OTRS"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to OTRSTicketForms 7.0.30 or OTRSTicketForms 8.0.4."
}
],
"source": {
"advisory": "OSA-2021-03",
"defect": [
"2020092942003178"
],
"discovery": "INTERNAL"
},
"title": "Dynamic templates reveal sensitive data when OTRS tags are used",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@otrs.com",
"DATE_PUBLIC": "2021-02-08T00:00:00.000Z",
"ID": "CVE-2020-1779",
"STATE": "PUBLIC",
"TITLE": "Dynamic templates reveal sensitive data when OTRS tags are used"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OTRSTicketForms",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "6.0.x",
"version_value": "6.0.40"
},
{
"version_affected": "\u003c=",
"version_name": "7.0.x",
"version_value": "7.0.29"
},
{
"version_affected": "\u003c=",
"version_name": "8.0.x",
"version_value": "8.0.3"
}
]
}
}
]
},
"vendor_name": "OTRS AG"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "L\u00e1szl\u00f3 Gyaraki"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/",
"refsource": "CONFIRM",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Upgrade to OTRSTicketForms 7.0.30 or OTRSTicketForms 8.0.4."
}
],
"source": {
"advisory": "OSA-2021-03",
"defect": [
"2020092942003178"
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
"assignerShortName": "OTRS",
"cveId": "CVE-2020-1779",
"datePublished": "2021-02-08T10:55:18.477Z",
"dateReserved": "2019-11-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:15:28.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-1779 (GCVE-0-2020-1779)
Vulnerability from cvelistv5 – Published: 2021-02-08 10:55 – Updated: 2024-09-16 17:15
VLAI
EPSS
VEX
Title
Dynamic templates reveal sensitive data when OTRS tags are used
Summary
When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions.
Severity
4.3 (Medium)
CWE
- CWE-200 - Information Exposure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://otrs.com/release-notes/otrs-security-advi… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OTRS AG | OTRSTicketForms |
Affected:
6.0.x , ≤ 6.0.40
(custom)
Affected: 7.0.x , ≤ 7.0.29 (custom) Affected: 8.0.x , ≤ 8.0.3 (custom) |
Date Public
2021-02-08 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:46:30.959Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OTRSTicketForms",
"vendor": "OTRS AG",
"versions": [
{
"lessThanOrEqual": "6.0.40",
"status": "affected",
"version": "6.0.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.0.29",
"status": "affected",
"version": "7.0.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.0.3",
"status": "affected",
"version": "8.0.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "L\u00e1szl\u00f3 Gyaraki"
}
],
"datePublic": "2021-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-08T10:55:18.000Z",
"orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
"shortName": "OTRS"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to OTRSTicketForms 7.0.30 or OTRSTicketForms 8.0.4."
}
],
"source": {
"advisory": "OSA-2021-03",
"defect": [
"2020092942003178"
],
"discovery": "INTERNAL"
},
"title": "Dynamic templates reveal sensitive data when OTRS tags are used",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@otrs.com",
"DATE_PUBLIC": "2021-02-08T00:00:00.000Z",
"ID": "CVE-2020-1779",
"STATE": "PUBLIC",
"TITLE": "Dynamic templates reveal sensitive data when OTRS tags are used"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OTRSTicketForms",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "6.0.x",
"version_value": "6.0.40"
},
{
"version_affected": "\u003c=",
"version_name": "7.0.x",
"version_value": "7.0.29"
},
{
"version_affected": "\u003c=",
"version_name": "8.0.x",
"version_value": "8.0.3"
}
]
}
}
]
},
"vendor_name": "OTRS AG"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "L\u00e1szl\u00f3 Gyaraki"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/",
"refsource": "CONFIRM",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2020-17/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Upgrade to OTRSTicketForms 7.0.30 or OTRSTicketForms 8.0.4."
}
],
"source": {
"advisory": "OSA-2021-03",
"defect": [
"2020092942003178"
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
"assignerShortName": "OTRS",
"cveId": "CVE-2020-1779",
"datePublished": "2021-02-08T10:55:18.477Z",
"dateReserved": "2019-11-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:15:28.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}