Release Note
OTRS Security Advisory 2020-04
February 07, 2020 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability.
Please send information regarding vulnerabilities in OTRS to: security@otrs.org
PGP Key
- pub 2048R/9C227C6B 2011-03-21
- uid OTRS Security Team <security@otrs.org>
- GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 7C6B
Security Advisory Details
-
-
- ID: OSA-2020-04
- Date: 2020-02-07
-
- Title: External interface does not invalidate user session
- Severity: Medium
- Product: OTRS 7.0.x
- Fixed in: OTRS 7.0.15
- FULL CVSS v3.1 VECTOR: 5.4
- References: CVE-2020-1768
- Ticket#2020011342001517
OSA-2020-04 External interface does not invalidate user session (CVE-2020-1768)
Product Affected:
This issue affects OTRS 7.0.x.
Problem:
In the external frontend system uses numerous background calls to the backend (to fetch data, check if there are updates, etc). The problem is that each background request is treated as user activity. Therefore, it’s enough to leave application open in the browser and user session would never expire (as it’s defined in SessionMaxIdleTime), even if there is no real user activity.
This issue affects:
OTRS
7.0.x version 7.0.14 and prior versions.
This issue was seen during production usage.
This issue has been assigned CVE-2020-1768
.
Solution:
Upgrade to OTRS 7.0.15
This issue is being tracked as 2020011342001517.
Modification History:
2020-02-07: Initial Publication.
Related Links:
TBD CVE-2020-1767 at cve.mitre.org
CVSS Score:
5.4 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Risk Level:
Medium