« Volver al listado

CVE-2021-21437

Estado: ModificadaMedia (4.3)—

Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Otrs — ItsmconfigurationmanagementOtrs — Otrscisincustomerfrontend

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21437",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@otrs.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@otrs.com",
      "affectedData": [
        {
          "vendor": "OTRS AG",
          "product": "OTRSCIsInCustomerFrontend",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.x",
              "versionType": "custom",
              "lessThanOrEqual": "7.0.15"
            }
          ]
        },
        {
          "vendor": "OTRS AG",
          "product": "ITSMConfigurationManagement",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.x",
              "versionType": "custom",
              "lessThanOrEqual": "7.0.24"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-03-22T09:15:12.953",
  "references": [
    {
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2021-07/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security@otrs.com"
    },
    {
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2021-07/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@otrs.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions"
    },
    {
      "lang": "es",
      "value": "Los agentes pueden ser capaces de visualizar Elementos de Configuración vinculados sin permisos, que son definidos en el Catálogo General. Este problema afecta a: OTRSCIsInCustomerFrontend versiones 7.0.15 y anteriores, ITSMConfigurationManagement versiones 7.0.24 y anteriores"
    }
  ],
  "lastModified": "2026-06-17T03:35:34.460",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otrs:itsmconfigurationmanagement:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22785061-8457-4745-8DA4-698A59CE6139",
              "versionEndIncluding": "7.0.24",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:otrs:otrscisincustomerfrontend:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEE941D9-D14E-4B97-BC43-843F1116C8F2",
              "versionEndIncluding": "7.0.15",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@otrs.com"
}