CVE-2020-11466

MEDIUM

Deskpro < 2019.8.0 - Improper Privilege Management in Ticket API Endpoint

Title source: llm
STIX 2.1

Description

An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve arbitrary information about all helpdesk tickets stored in database with numerous filters. This leaked sensitive information to unauthorized parties. Additionally, it leaked ticket authentication code, making it possible to make changes to a ticket.

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/
Release Notes, Vendor Advisory x_refsource_misc
https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09

Scores

CVSS v3 4.3
EPSS 0.0123
EPSS Percentile 65.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-269
Status published
Products (1)
deskpro/deskpro < 2019.8.0
Published Apr 01, 2020
Tracked Since Feb 18, 2026