What’s Vulnerable › Vulnerabilities

CVE-2020-1768: External Interface does not invalidate session

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-07 · updated 2026-06-17
• Weakness: CWE-613

Description

The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions.

Affected products

• OTRS AG OTRS: from 7.0.0 through 7.0.14

References

• https://otrs.com/release-notes/otrs-security-advisory-2020-04/
• https://otrs.com/release-notes/otrs-security-advisory-2020-04/

Get alerted when CVE-2020-1768 or the next vulnerability affects your stack