PT-2021-14506 · Otrs Ag · Otrs Ag Survey

Rayhan Ahmed Niloy · Published 2021-02-08 · Updated 2021-02-09 · CVE-2021-21434

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OTRS AG Survey versions 6.0.20 and prior OTRS AG Survey versions 7.0.19 and prior

Description The issue allows a survey administrator to craft a survey that can execute malicious code in the agent interface, affecting other agents who want to make changes to the survey.

Recommendations For OTRS AG Survey versions 6.0.20 and prior, update to a version later than 6.0.20 to resolve the issue. For OTRS AG Survey versions 7.0.19 and prior, update to a version later than 7.0.19 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21434

Affected Products

Otrs Ag Survey

References · 7

• https://otrs.com/release-notes/otrs-security-advisory-2021-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21434 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21434 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21434 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21434 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21434 · Security Note
• https://t.me/cvenotify/9568 · Telegram Post