{"api_version":"1","generated_at":"2026-04-23T02:36:07+00:00","cve":"CVE-2020-1776","urls":{"html":"https://cve.report/CVE-2020-1776","api":"https://cve.report/api/cve/CVE-2020-1776.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-1776","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-1776"},"summary":{"title":"CVE-2020-1776","description":"When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions.","state":"PUBLIC","assigner":"security@otrs.com","published_at":"2020-07-20 21:15:00","updated_at":"2023-08-31 03:15:00"},"problem_types":["CWE-613"],"metrics":[],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2020-13/","name":"https://otrs.com/release-notes/otrs-security-advisory-2020-13/","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"OTRS Security Advisory 2020-13 | OTRS","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","name":"[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3551-1] otrs2 security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1776","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1776","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Marvin Voormann","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"1776","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1776","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1776","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1776","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"otrs","cpe5":"otrs","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-1776","qid":"180654","title":"Debian Security Update for otrs2 (CVE-2020-1776)"},{"cve":"CVE-2020-1776","qid":"6000085","title":"Debian Security Update for otrs2 (DLA 3551-1)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@otrs.com","DATE_PUBLIC":"2020-07-20T00:00:00.000Z","ID":"CVE-2020-1776","STATE":"PUBLIC","TITLE":"Invalidating or changing user does not invalidate session"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"((OTRS)) Community Edition","version":{"version_data":[{"version_affected":"<=","version_name":"6.0.x","version_value":"6.0.28"}]}},{"product_name":"OTRS","version":{"version_data":[{"version_affected":"<=","version_name":"7.0.x","version_value":"7.0.18"},{"version_affected":"<=","version_name":"8.0.x","version_value":"8.0.4"}]}}]},"vendor_name":"OTRS AG"}]}},"credit":[{"lang":"eng","value":"Marvin Voormann"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-613 Insufficient Session Expiration"}]}]},"references":{"reference_data":[{"name":"https://otrs.com/release-notes/otrs-security-advisory-2020-13/","refsource":"CONFIRM","url":"https://otrs.com/release-notes/otrs-security-advisory-2020-13/"},{"refsource":"MLIST","name":"[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update","url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"}]},"solution":[{"lang":"eng","value":"Upgrade to OTRS 8.0.5, OTRS 7.0.19, ((OTRS)) Community Edition 6.0.29\nPatch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/4514f95f747be368c3dc9a9452ff9aa66506648d"}],"source":{"advisory":"OSA-2020-13","defect":["2020052042004084"],"discovery":"INTERNAL"}},"nvd":{"publishedDate":"2020-07-20 21:15:00","lastModifiedDate":"2023-08-31 03:15:00","problem_types":["CWE-613"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*","versionEndExcluding":"6.0.29","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.1","versionEndExcluding":"8.0.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.19","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"1776","Ordinal":"161050","Title":"CVE-2020-1776","CVE":"CVE-2020-1776","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"1776","Ordinal":"1","NoteData":"When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"1776","Ordinal":"2","NoteData":"2020-07-20","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"1776","Ordinal":"3","NoteData":"2020-07-20","Type":"Other","Title":"Modified"}]}}}