CVE-2020-11463 Missing authorization in n/a
An attacker can retrieve cleartext email credentials via an unvalidated API endpoint, enabling full email access and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11463?
CVE-2020-11463 is a high-severity missing authorization vulnerability in n/a, published on 1 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to get full access to all emails sent or received by the system including password reset emails, making it possible to reset any user's password.
Weakness: CWE-862
Which versions are affected by CVE-2020-11463?
It affects 1 product.
Products include Deskpro Deskpro.
How do I fix CVE-2020-11463?
No fix has been published for CVE-2020-11463 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-11463 being exploited?
There is no known exploitation of CVE-2020-11463 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2pp3-576m-vhmq.