CVE-2020-11465

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/install helpdesk applications and leak current applications' configurations, including applications used as user sources (used for authentication). This enables an attacker to forge valid authentication models that resembles any user on the system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory
https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory

Timeline

Published: Apr 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-114664.3An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an at CVE-2020-114677.2An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/CVE-2020-114697.8Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows CVE-2020-11477.8A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the CVE-2020-114703.3Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user'CVE-2020-114747.8NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant.CVE-2020-114767.2Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.CVE-2020-11485.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-114839.8NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain CVE-2020-114844.9NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an atta CVE-2020-114858.8NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the CVE-2020-114869.8NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software