PT-2021-14508 · Otrs Ag · Otrs Ag Otrscisincustomerfrontend

Bernhard Lehr · Published 2021-02-08 · Updated 2021-02-10 · CVE-2021-21436

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS AG OTRSCIsInCustomerFrontend versions 7.0.14 and prior versions.

Description The issue allows agents to see and link Config Items without the necessary permissions, which are defined in the General Catalog.

Recommendations For OTRS AG OTRSCIsInCustomerFrontend versions 7.0.14 and prior versions, update to a version that includes the necessary permission checks to restrict access to Config Items. As a temporary workaround, consider restricting access to the General Catalog to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-264

Related Identifiers

CVE-2021-21436

Affected Products

Otrs Ag Otrscisincustomerfrontend

References · 7

• https://cve.org/CVERecord?id=CVE-2021-21436 · Security Note
• https://ubuntu.com/security/CVE-2021-21436 · Vendor Advisory
• https://otrs.com/release-notes/otrs-security-advisory-2021-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21436 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21436 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21436 · Vendor Advisory
• https://t.me/cvenotify/9570 · Telegram Post