CVE-2020-1778CWE-287

Bypassing user account validation

Medium · published November 23, 2020

CVSS v3.1
4.1
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00651 · 50.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2020-11-23T15:32Z
EPSS history
Timeline
  • 23 NOV 15:32Z
    Bypassing user account validation
    cvelistv5