CVE-2020-7993
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other...
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
- Record
CVE-2020-7993- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
- Record
CVE-2020-7993- Updated
- 2026-11-02
EUVDEUVD-2020-28909 No score
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
- Record
EUVD-2020-28909- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7g5v-9qx2-vmfq No score
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other...
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
- Record
GHSA-7g5v-9qx2-vmfq- Weakness
- CWE-269
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7993
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
- Record
UBUNTU-CVE-2020-7993- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prototypejsUbuntu:16.04:LTS |
All versions, plus listed versions 1.7.1-3 |
None known |
prototypejsUbuntu:18.04:LTS |
All versions, plus listed versions 1.7.1-3 |
None known |
prototypejsUbuntu:20.04:LTS |
All versions, plus listed versions 1.7.1-3 |
None known |
prototypejsUbuntu:22.04:LTS |
All versions, plus listed versions 1.7.1-3.1 |
None known |
prototypejsUbuntu:24.04:LTS |
All versions, plus listed versions 1.7.3-1 |
None known |
prototypejsUbuntu:25.10 |
All versions, plus listed versions 1.7.3-2 |
None known |
prototypejsUbuntu:26.10 |
All versions, plus listed versions 1.7.3-2build1 |
None known |
prototypejsUbuntu:26.04:LTS |
All versions, plus listed versions 1.7.3-21.7.3-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7993 is a medium vulnerability (CVSS 4.3) in Prototypejs Prototype, published February 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 54th percentile. No source names a fixed version.
References
github.com/prototypejs/prototype/blob/master/CHANGELOG
medium.com/%40vbharad/improper-access-control-vulnerability-in-prototype-1-6-0-1-framework-379cc3a05079
nvd.nist.gov/vuln/detail/CVE-2020-7993
ubuntu.com/security/CVE-2020-7993
cve.org/CVERecord?id=CVE-2020-7993