CVE-2020-1768 : Security Advisory and Response

A vulnerability in OTRS version 7.0.x allows an external interface to not invalidate sessions, potentially impacting user activity and security.

Understanding CVE-2020-1768

This CVE involves an issue where the external frontend system in OTRS makes background calls to the backend, affecting user sessions.

What is CVE-2020-1768?

The vulnerability in OTRS version 7.0.x prevents the SessionMaxIdleTime from being reached due to background requests being treated as user activity, leading to session invalidation concerns.

The Impact of CVE-2020-1768

The CVSS base score for this vulnerability is 5.4 (Medium severity) with low confidentiality impact, no integrity impact, and low availability impact. The vulnerability requires low privileges and has no user interaction or scope impact.

Technical Details of CVE-2020-1768

The technical details of this CVE are as follows:

Vulnerability Description

The external interface issue results in insufficient session expiration due to background calls treated as user activity, affecting OTRS 7.0.x versions up to 7.0.14.

Affected Systems and Versions

Product: OTRS
Vendor: OTRS AG
Versions affected: OTRS 7.0.x (<= 7.0.14)

Exploitation Mechanism

The vulnerability can be exploited through network-based attacks with low complexity, requiring no user interaction.

Mitigation and Prevention

To address CVE-2020-1768, consider the following steps:

Immediate Steps to Take

Upgrade to OTRS 7.0.15 to mitigate the vulnerability.

Long-Term Security Practices

Implement regular security audits to identify and resolve similar issues promptly.

Patching and Updates

Stay updated with security advisories from OTRS to apply patches that address vulnerabilities.