PT-2021-6460 · Otrs Ag+1 · Otrs+2

Published 2021-07-26 · Updated 2024-08-06 · CVE-2021-21443

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS AG (OTRS) Community Edition versions 6.0.1 and later OTRS AG OTRS versions prior to 7.0.27

Description The issue is related to errors in permission handling in the OTRS ticket system, allowing an attacker to remotely access confidential data. Agents are able to list customer user emails without required permissions in the bulk action screen.

Recommendations For OTRS AG (OTRS) Community Edition versions 6.0.1 and later, update to a version that includes the necessary permission handling fixes. For OTRS AG OTRS versions prior to 7.0.27, update to version 7.0.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the bulk action screen to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-275

Related Identifiers

ALT-PU-2021-2917

ALT-PU-2021-3039

ALT-PU-2021-3058

ALT-PU-2024-10583

BDU:2022-01681

CVE-2021-21443

DLA-3551-1

Affected Products

Alt Linux

Otrs

Otrs Community Edition

References · 13

• https://otrs.com/release-notes/otrs-security-advisory-2021-13 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21443 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21443 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21443 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21443 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3551-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21443 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01681 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-21443 · Security Note
• https://github.com/znuny/Znuny/commit/48ee5532911be5453cc8bed1e437a64c21bcc072 · Note
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html · Note
• https://t.me/cibsecurity/26470 · Telegram Post