CVE-2021-36095: User enumeration issue using "lost password" feature
Published Sep 6, 2021
·Updated
Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
Affected Software
2 affected components
OTRS OTRS>=6.0.1
OTRS OTRS>=7.0.0<7.0.29
Remediation
Information
Update to OTRS 7.0.29.
Event History
Sep 6, 2021
CVE Published
via MITRE·01:15 PM
Data Sourced
via MITRE·01:15 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-36095.
2
How does the vulnerability allow malicious attackers to find valid user logins?
The vulnerability allows malicious attackers to find valid user logins by exploiting the 'lost password' feature.
3
Which versions of OTRS Community Edition are affected?
OTRS Community Edition versions 6.0.1 and later versions are affected.
4
Which versions of OTRS 7.x are affected?
OTRS 7.0.x versions prior to 7.0.28 are affected.
5
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is medium, with a CVSS score of 5.3.