CVE-2020-11464

An issue was discovered in Deskpro before 2019.8.0

Medium · published April 1, 2020

CVSS v3.0
6.5
EPSS
1%
Percentile
68.0
In the wild
Unconfirmed
What it is

An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive information about all users registered on the system. This includes their full name, privilege, email address, phone number, etc.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01200 · 68.0th percentile
Published
2020-04-01T20:51Z
EPSS history
Timeline
  • 01 APR 20:51Z
    An issue was discovered in Deskpro before 2019.8.0
    cvelistv5