CVE-2021-21437: Config Items are shown to users without permission
First published: Mon Mar 22 2021(Updated: )
Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions
Credit: security@otrs.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Otrs Itsmconfigurationmanagement | >=7.0.0<=7.0.24 | |
| Otrs Otrscisincustomerfrontend | >=7.0.0<=7.0.15 |
Remedy
Update to ITSMConfigurationManagement 7.0.25 and OTRSCIsInCustomerFrontend 7.0.16.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-21437.
What is the severity of CVE-2021-21437?
The severity of CVE-2021-21437 is medium with a severity value of 4.3.
Which software versions are affected by CVE-2021-21437?
OTRSCIsInCustomerFrontend versions 7.0.15 and prior, and ITSMConfigurationManagement versions 7.0.24 and prior are affected by CVE-2021-21437.
What is the impact of CVE-2021-21437?
Agents are able to see linked Config Items without permissions, which are defined in General Catalog.
How can I fix CVE-2021-21437?
Upgrade to a version of OTRSCIsInCustomerFrontend or ITSMConfigurationManagement that is not affected by CVE-2021-21437.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/otrs
- canonical/otrs itsmconfigurationmanagement
- version/otrs itsmconfigurationmanagement/7.0.0
- version/otrs itsmconfigurationmanagement/7.0.24
- canonical/otrs otrscisincustomerfrontend
- version/otrs otrscisincustomerfrontend/7.0.0
- version/otrs otrscisincustomerfrontend/7.0.15