title: Session / Password / Password token leak
description: An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS; 7.0.15 and prior versions.
problem types: CWE-331 Insufficient Entropy
affected:
{
vendor: OTRS AG
product: ((OTRS)) Community Edition
versions:
version: 5.0.41 and prior, status: affected
version: 6.0.26 and prior, status: affected
}
{
vendor: OTRS AG
product: OTRS
versions:
version: 7.0.15 and prior, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
]
solutions: Upgrade to OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, 5.0.42
Patch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/ab253734bc211541309b9f8ea2b8b70389c4a64e
Patch for ((OTRS)) Community Edition 5: https://github.com/OTRS/otrs/commit/4955521af50238046847bce51ad9865950324f77