PT-2021-6760 · Otrs Ag · Otrs+1

Julian Droste + 1 · Published 2021-07-26 · Updated 2023-08-31 · CVE-2021-21440

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS AG (OTRS) Community Edition versions 6.0.1 and later OTRS AG OTRS versions 7.0.27 and prior OTRS AG OTRS versions 8.0.14 and prior

Description The issue is related to the disclosure of information in the OTRS ticket system. It allows a remote attacker to gain access to confidential data. The problem arises when generated support bundles contain private S/MIME and PGP keys if the containing folder is not hidden.

Recommendations For OTRS AG (OTRS) Community Edition versions 6.0.1 and later, consider hiding the containing folder to prevent private key exposure. For OTRS AG OTRS versions 7.0.27 and prior, restrict access to the support bundles to minimize the risk of exploitation. For OTRS AG OTRS versions 8.0.14 and prior, avoid using the affected support bundle feature until the issue is resolved. As a temporary workaround, consider disabling the generation of support bundles until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-02152

CVE-2021-21440

DLA-3551-1

Affected Products

Otrs

Otrs Community Edition

References · 13

• https://ubuntu.com/security/CVE-2021-21440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21440 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21440 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3551-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21440 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21440 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21440 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21440 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2021-10 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02152 · Security Note
• https://github.com/znuny/Znuny/commit/c5c90087d4187da5c456a80289fa088a19511934 · Note
• https://t.me/cibsecurity/26469 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html · Note