PT-2020-6429 · Otrs Ag+1 · Otrs+2

Published 2020-12-29 · Updated 2024-08-06 · CVE-2021-21439

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OTRS AG (OTRS) Community Edition versions 6.0.1 and later OTRS AG OTRS versions 7.0.x through 7.0.26 OTRS AG OTRS versions 8.0.x through 8.0.13

Description The issue is related to deficiencies in handling exceptional states in the OTRS ticket system. It can be exploited by a remote attacker using a specially crafted URL in an email, leading to a denial of service (DoS) attack. This can cause high CPU usage, low quality of service, or even bring the system to a halt.

Recommendations For OTRS AG (OTRS) Community Edition versions 6.0.1 and later, update to a version that includes a fix for this issue. For OTRS AG OTRS versions 7.0.x through 7.0.26, update to a version later than 7.0.26. For OTRS AG OTRS versions 8.0.x through 8.0.13, update to a version later than 8.0.13. As a temporary workaround, consider restricting the handling of emails with specially crafted URLs to minimize the risk of exploitation.

Fix

DoS

Improper Check for Exceptional Conditions

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-755

Related Identifiers

ALT-PU-2021-2917

ALT-PU-2021-3039

ALT-PU-2021-3058

ALT-PU-2024-10583

BDU:2021-04651

CVE-2021-21439

DLA-3551-1

Affected Products

Alt Linux

Otrs

Otrs Community Edition

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-21439 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2021-09 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21439 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21439 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21439 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3551-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21439 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21439 · Security Note
• https://bdu.fstec.ru/vul/2021-04651 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21439 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html · Note
• https://t.me/cibsecurity/25430 · Telegram Post