PT-2020-6430 · Otrs Ag · Otrs+1

Published 2020-12-29 · Updated 2023-08-31 · CVE-2021-21441

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS AG (OTRS) Community Edition versions 6.0.1 through 6.0.x OTRS AG OTRS versions prior to 7.0.26

Description The issue is related to a lack of protection of the web page structure in the ticket request system OTRS, allowing an attacker to collect various information by having a specially crafted email shown in the overview screen. This can be done without requiring any user interaction, by sending a specially crafted email to the system. The attack can be performed remotely.

Recommendations For OTRS AG (OTRS) Community Edition versions 6.0.1 through 6.0.x, update to a version that includes the fix for this issue. For OTRS AG OTRS versions prior to 7.0.26, update to version 7.0.26 or later. As a temporary workaround, consider restricting access to the ticket overview screens until a patch is available. Avoid displaying emails in the overview screen that may contain malicious content.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04652

CVE-2021-21441

DLA-3551-1

Affected Products

Otrs

Otrs Community Edition

References · 13

• https://otrs.com/release-notes/otrs-security-advisory-2021-11 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21441 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21441 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-21441 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04652 · Security Note
• https://osv.dev/vulnerability/DLA-3551-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21441 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21441 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21441 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21441 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html · Note
• https://t.me/cibsecurity/25480 · Telegram Post
• https://t.me/cvenotify/16434 · Telegram Post