Skip to content
OpenAdvisories
Medium DLA-2198-1 3 CVEs

otrs2 - security update

Published May 1, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 otrs2 3.3.18-1+deb8u15

Vulnerabilities 3

  • Medium 6.5
    CVE-2020-1772

    Information Disclosure

    It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versio…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 4.5
    CVE-2020-1774

    Information disclosure

    When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: …

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Low 2.4
    CVE-2020-1770

    Information disclosure in support bundle files

    Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu