Description
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| OTRSCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.6% · top 24% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
OTRS AG · ((OTRS)) Community Edition
- affected 5.0.x – ≤ 5.0.41
- affected 6.0.x – ≤ 6.0.26
- affected 7.0.x – ≤ 7.0.15
What to do
Solution: Upgrade to OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, 5.0.42 Patch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/c0255365d5c455272b2b9e7bb1f6c96c3fce441b Patch for ((OTRS)) Community Edition 5: https://github.com/OTRS/otrs/commit/96cc7826d6ce260204ff629fc968edd2787b7f6b
References (6)
- https://otrs.com/release-notes/otrs-security-advisory-2020-09/ (opens in a new tab)x_transferred
- openSUSE-SU-2020:0551 (opens in a new tab)vendor-advisoryx_transferred
- [debian-lts-announce] 20200501 [SECURITY] [DLA 2198-1] otrs2 security update (opens in a new tab)mailing-listx_transferred
- openSUSE-SU-2020:1475 (opens in a new tab)vendor-advisoryx_transferred
- openSUSE-SU-2020:1509 (opens in a new tab)vendor-advisoryx_transferred
- [debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update (opens in a new tab)mailing-listx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-1772)Record last updated .