CVE-2020-11465

An issue was discovered in Deskpro before 2019.8.0

High · published April 1, 2020

CVSS v3.0
8.8
EPSS
2%
Percentile
79.6
In the wild
Unconfirmed
What it is

An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/install helpdesk applications and leak current applications' configurations, including applications used as user sources (used for authentication). This enables an attacker to forge valid authentication models that resembles any user on the system.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01909 · 79.6th percentile
Published
2020-04-01T20:51Z
EPSS history
Timeline
  • 01 APR 20:51Z
    An issue was discovered in Deskpro before 2019.8.0
    cvelistv5