PT-2021-14509 · Unknown · Otrs Ag Otrscisincustomerfrontend+1

Jaroslav Balaz · CVE-2021-21437 · Published 2021-03-22 · Updated 2022-10-24

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRSCIsInCustomerFrontend versions 7.0.15 and prior ITSMConfigurationManagement versions 7.0.24 and prior

Description The issue allows agents to see linked Config Items without the necessary permissions, which are defined in the General Catalog.

Recommendations For OTRSCIsInCustomerFrontend versions 7.0.15 and prior, update to a version later than 7.0.15 to resolve the issue. For ITSMConfigurationManagement versions 7.0.24 and prior, update to a version later than 7.0.24 to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-264

Related Identifiers

CVE-2021-21437

Affected Products

Itsmconfigurationmanagement

Otrs Ag Otrscisincustomerfrontend

References · 4

• https://otrs.com/release-notes/otrs-security-advisory-2021-07 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21437 · Security Note
• https://t.me/cvenotify/11695 · Telegram Post