CVE-2020-1775: Information disclosure in external interface

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-08 · updated 2026-06-17
Weakness: CWE-200

Description

BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior versions.

Affected products

OTRS AG OTRS: from 7.0.0 before 7.0.18; from 8.0.0 before 8.0.3 — fixed in 7.0.18, 8.0.3

How to fix

Upgrade to a fixed version: OTRS AG OTRS 7.0.18, 8.0.3. Check the vendor advisory for mitigations.

References

https://otrs.com/release-notes/otrs-security-advisory-2020-12/
https://otrs.com/release-notes/otrs-security-advisory-2020-12/

Get alerted when CVE-2020-1775 or the next vulnerability affects your stack