Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2020-1770: Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prio...
CVE-2020-1770 · published 6 years ago
Summary
Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| otrs | otrs |
>= 5.0.0, <= 5.0.41 >= 6.0.0, <= 6.0.26 >= 7.0.0, <= 7.0.15 cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:* |
| opensuse | backports_sle |
15.0 cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:* |
| opensuse | leap |
15.1 15.2 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
| debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prio...
Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://otrs.com/release-notes/otrs-security-advisory-2020-07/ Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-201Insertion of Sensitive Information Into Sent Data
CWE-200Information Exposure
Timeline
Published27 Mar 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2020-1770 · NVD
Track software like this
Free during beta