CVE-2020-11463 Information

Description

An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user’s privilege allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts including incoming and outgoing email credentials. This enables an attacker to get full access to all emails sent or received by the system including password reset emails making it possible to reset any user’s password.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/ https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09 https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

7.5