CVE-2020-11463

An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to get full access to all emails sent or received by the system including password reset emails, making it possible to reset any user's password.

• CWE-862

• https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory
• https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory

Published

Apr 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11455LimeSurvey before 4.1.12+200324 contains a path traversal vu…9.8
• CVE-2020-11456LimeSurvey before 4.1.12+200324 has stored XSS in applicatio…5.4
• CVE-2020-11457pfSense before 2.4.5 has stored XSS in system_usermanager_ad…5.4
• CVE-2020-11458app/Model/feed.php in MISP before 2.4.124 allows administrat…4.9
• CVE-2020-1146<p>An elevation of privilege vulnerability exists when the M…6.6
• CVE-2020-11462An issue was discovered in OpenVPN Access Server before 2.7.…7.5
• CVE-2020-11464An issue was discovered in Deskpro before 2019.8.0. The /api…4.3
• CVE-2020-11465An issue was discovered in Deskpro before 2019.8.0. The /api…8.8
• CVE-2020-11466An issue was discovered in Deskpro before 2019.8.0. The /api…4.3
• CVE-2020-11467An issue was discovered in Deskpro before 2019.8.0. This pro…7.2
• CVE-2020-11469Zoom Client for Meetings through 4.6.8 on macOS copies runwi…7.8
• CVE-2020-1147A remote code execution vulnerability exists in .NET Framewo…7.8