CVE-2020-1767 Possible to send drafted messages as wrong agent
An attacker can send drafted messages as another agent, disguising their identity to customers in the OTRS ticketing system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-1767?
CVE-2020-1767 is a low-severity vulnerability in Debian Debian Linux, published on 10 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: ((OTRS)) Community Edition 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
Which versions are affected by CVE-2020-1767?
It affects 2 products.
Products include Debian Debian Linux, Otrs Otrs.
How do I fix CVE-2020-1767?
Upgrade to a fixed version.
Is CVE-2020-1767 being exploited?
There is no known exploitation of CVE-2020-1767 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-1767, GHSA-xqvr-25w4-fgw8, UBUNTU-CVE-2020-1767.