CVE-2020-1779CWE-200

Dynamic templates reveal sensitive data when OTRS tags are used

Medium · published February 8, 2021

CVSS v3.1
4.3
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01004 · 62.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-02-08T10:55Z
EPSS history
Timeline
  • 08 FEB 10:55Z
    Dynamic templates reveal sensitive data when OTRS tags are used
    cvelistv5