Lucene search

OTRSCVELIST:CVE-2021-21437

HistoryMar 22, 2021 - 8:50 a.m.

CVE-2021-21437 Config Items are shown to users without permission

2021-03-2208:50:17

CWE-264

OTRS

www.cve.org

cve-2021-21437

general catalog

otrscisincustomerfrontend

itsmconfigurationmanagement

information security

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions

CNA Affected

[
  {
    "product": "OTRSCIsInCustomerFrontend",
    "vendor": "OTRS AG",
    "versions": [
      {
        "lessThanOrEqual": "7.0.15",
        "status": "affected",
        "version": "7.0.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "ITSMConfigurationManagement",
    "vendor": "OTRS AG",
    "versions": [
      {
        "lessThanOrEqual": "7.0.24",
        "status": "affected",
        "version": "7.0.x",
        "versionType": "custom"
      }
    ]
  }
]

References

otrs.com/release-notes/otrs-security-advisory-2021-07/

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVELIST:CVE-2021-21437