CVE-2020-1776CWE-613

Invalidating or changing user does not invalidate session

Low · published July 20, 2020

CVSS v3.1
3.5
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00918 · 59.9th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2020-07-20T21:04Z
EPSS history
Timeline
  • 20 JUL 21:04Z
    Invalidating or changing user does not invalidate session
    cvelistv5