When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to…
OTRS·CWE-201·Published 2020-04-28
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.
Cuando el usuario descarga claves y certificados de PGP o S/MIME, el archivo exportado presenta el mismo nombre para las claves privadas y públicas. Por lo tanto, es posible mezclarlos y enviar la clave privada a un tercero en lugar de la clave pública. Este problema afecta a ((OTRS)) Community Edition: versiones 5.0.42 y anteriores, versiones 6.0.27 y anteriores. OTRS: versiones 7.0.16 y anteriores.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 2.0 | Primary | NVD | 4.0 | 8.0 | 2.9 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| 3.1 | Primary | NVD | 4.9 | 1.2 | 3.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | Primary | cve.org | 4.5 | — | — | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
| 3.1 | Primary | cve.org | 4.5 | — | — | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
| 3.1 | Secondary | NVD | 4.5 | 0.9 | 3.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |