PT-2021-21116 · Otrs Ag · Otrs+1

Matthias Terlinde · Published 2021-09-06 · Updated 2021-09-13 · CVE-2021-36096

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: OTRS AG (OTRS) Community Edition versions 6.0.1 and later OTRS AG OTRS versions 7.0.28 and prior OTRS AG OTRS versions 8.0.15 and prior

Description: The issue is related to Generated Support Bundles containing private S/MIME and PGP keys if the containing folder is not hidden.

Recommendations: For OTRS AG (OTRS) Community Edition versions 6.0.1 and later, consider hiding the containing folder to prevent exposure of private keys. For OTRS AG OTRS versions 7.0.28 and prior, consider hiding the containing folder to prevent exposure of private keys. For OTRS AG OTRS versions 8.0.15 and prior, consider hiding the containing folder to prevent exposure of private keys. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-312

CWE-200

Related Identifiers

CVE-2021-36096

Affected Products

Otrs

Otrs Community Edition

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36096 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-36096 · Security Note
• https://ubuntu.com/security/CVE-2021-36096 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36096 · Vendor Advisory
• https://otrs.com/release-notes/otrs-security-advisory-2021-10 · Vendor Advisory
• https://t.me/cibsecurity/28302 · Telegram Post
• https://t.me/cvenotify/20693 · Telegram Post