CVE Feed

    Dashboard / CVE / CVE-2020-11463

    CVE-2020-11463

    An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to get full access to all emails sent or received by the system including password reset emails, making it possible to reset any user's password.

    Published:Apr 1, 2020
    Last Modified:Nov 21, 2024
    EPS:Apr 1, 2020
    EPSS Score:0.00425
    CVSS Score:7.5

    Affected Products

    Vendor
    Deskpro
    Product
    Deskpro

    Exploits

    https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2021-35391 (CVSS 7.2) — Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute…
    CVE-2021-36695 (CVSS 5.4) — Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (X…
    CVE-2021-36696 (CVSS 5.4) — Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (X…
    CVE-2020-28722 (CVSS 5.4) — Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vul…
    CVE-2020-11464 (CVSS 4.3) — An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a use…
    CVE-2020-11465 (CVSS 8.8) — An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a us…
    CVE-2020-11466 (CVSS 4.3) — An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a us…
    CVE-2020-11467 (CVSS 7.2) — An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk…
    CVE-2007-2011 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in login.php in DeskPro 2.0.1 allows remote attackers to inject arbit…
    CVE-2007-1012 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in faq.php in DeskPRO 1.1.0 allows remote attackers to inject arbitra…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High