CVE-2021-21437

LOW

OTRS ITSM <7.0.24 & CIsInCustomerFrontend <7.0.15 - Missing Authorization for Linked Config Items

Title source: llm

Description

Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions

References (1)

Core 1

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://otrs.com/release-notes/otrs-security-advisory-2021-07/

Scores

CVSS v3 3.5

EPSS 0.0067

EPSS Percentile 47.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-264 CWE-862

Status published

Products (2)

otrs/itsmconfigurationmanagement 7.0.0 - 7.0.24

otrs/otrscisincustomerfrontend 7.0.0 - 7.0.15

Published Mar 22, 2021

Tracked Since Feb 18, 2026