PT-2021-14511 · Otrs Ag · Otrs Ag Time Accounting

Balázs Úr · Published 2021-07-26 · Updated 2021-08-04 · CVE-2021-21442

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OTRS AG Time Accounting versions prior to 7.0.19

Description The issue allows for the injection of malicious JS code into certain fields in the project create screen. This code may be executed in the Reporting screen.

Recommendations For versions prior to 7.0.19, update to version 7.0.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the Reporting screen and the project create screen to minimize the risk of exploitation. Avoid using the affected fields in the project create screen until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21442

Affected Products

Otrs Ag Time Accounting

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-21442 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2021-12 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21442 · Vendor Advisory
• https://t.me/cibsecurity/26471 · Telegram Post