CVE-2020-1774 : When user downloads PGP or S/MIME keys/certificates, exported file has same name

When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.

Published 2020-04-28 14:15:14

Updated 2023-08-31 03:15:12

Source OTRS AG

View at NVD, CVE.org

Products affected by CVE-2020-1774

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Otrs » Otrs » Community Edition
Versions from including (>=) 6.0.0 and up to, including, (<=) 6.0.27
cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*
Matching versions
Otrs » Otrs » Community Edition
Versions from including (>=) 5.0.0 and up to, including, (<=) 5.0.42
cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*
Matching versions
Otrs » Otrs
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.16
cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-1774

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 45 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-1774

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
4.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N	0.9	3.6	OTRS AG
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2020-1774

CWE-201 Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Assigned by: security@otrs.com (Secondary)

References for CVE-2020-1774

https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html

[SECURITY] [DLA 2198-1] otrs2 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://otrs.com/release-notes/otrs-security-advisory-2020-11/

OTRS Security Advisory 2020-11 | OTRS
Release Notes;Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

[SECURITY] [DLA 3551-1] otrs2 security update

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-1774

Products affected by CVE-2020-1774

Exploit prediction scoring system (EPSS) score for CVE-2020-1774

CVSS scores for CVE-2020-1774

CWE ids for CVE-2020-1774

References for CVE-2020-1774