CVE-2020-11465

An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/install helpdesk applications and leak current applications' configurations, including applications used as user sources (used for authentication). This enables an attacker to forge valid authentication models that resembles any user on the system.

• CWE-862

• https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory
• https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory

Published

Apr 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11457pfSense before 2.4.5 has stored XSS in system_usermanager_ad…5.4
• CVE-2020-11458app/Model/feed.php in MISP before 2.4.124 allows administrat…4.9
• CVE-2020-1146<p>An elevation of privilege vulnerability exists when the M…6.6
• CVE-2020-11462An issue was discovered in OpenVPN Access Server before 2.7.…7.5
• CVE-2020-11463An issue was discovered in Deskpro before 2019.8.0. The /api…7.5
• CVE-2020-11464An issue was discovered in Deskpro before 2019.8.0. The /api…4.3
• CVE-2020-11466An issue was discovered in Deskpro before 2019.8.0. The /api…4.3
• CVE-2020-11467An issue was discovered in Deskpro before 2019.8.0. This pro…7.2
• CVE-2020-11469Zoom Client for Meetings through 4.6.8 on macOS copies runwi…7.8
• CVE-2020-1147A remote code execution vulnerability exists in .NET Framewo…7.8
• CVE-2020-11470Zoom Client for Meetings through 4.6.8 on macOS has the disa…3.3
• CVE-2020-11474NCP Secure Enterprise Client before 10.15 r47589 allows a sy…7.8