CVE-2020-1768CWE-613

External Interface does not invalidate session

Medium · published February 7, 2020

CVSS v3.1
5.4
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00747 · 54.3th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2020-02-07T15:42Z
EPSS history
Timeline
  • 07 FEB 15:42Z
    External Interface does not invalidate session
    cvelistv5