Back
CVE-2020-1776
Invalidating or changing user does not invalidate session
Low3.5EPSS 0.92%
- Published
- Updated
- Reserved
- Assigned by
- OTRS
Description
When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| OTRSCNA (assigner) | 3.1 | Low3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.92% · top 40% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.
Weakness
Affected products
OTRS AG · ((OTRS)) Community Edition
- affected 6.0.x – ≤ 6.0.28
- affected 7.0.x – ≤ 7.0.18
- affected 8.0.x – ≤ 8.0.4
What to do
Solution: Upgrade to OTRS 8.0.5, OTRS 7.0.19, ((OTRS)) Community Edition 6.0.29 Patch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/4514f95f747be368c3dc9a9452ff9aa66506648d
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-1776)Record last updated .