OTRS Security Advisory 2021-07

Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Please send information regarding vulnerabilities in OTRS to: security@otrs.org

Security Advisory Details

• ID: OSA-2021-07
• Date: 2021-03-22
• Title: Config Items are shown to users without permission
• Severity: 3.5 LOW
• Product: ITSMConfigurationManagement 7.0.24 and OTRSCIsInCustomerFrontend 7.0.15
• Fixed in: ITSMConfigurationManagement 7.0.25 and OTRSCIsInCustomerFrontend 7.0.16
• FULL CVSS v3.1 VECTOR: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
• References: CVE-2021-21437

PRODUCT AFFECTED:

This issue affects OTRSCIsInCustomerFrontend 7.0.x. This issue affects ITSMConfigurationManagement 7.0.x.

PROBLEM:

Agents are able to see linked Config Items without permissions, which are defined in General Catalog.

This issue affects:

OTRSCIsInCustomerFrontend 7.0.15 and prior versions,

ITSMConfigurationManagement 7.0.24 and prior versions

This issue was found during internal product security testing or research.

This issue has been assigned CVE-2021-21437.

SOLUTION:

Update to ITSMConfigurationManagement 7.0.25 and OTRSCIsInCustomerFrontend 7.0.16.

This issue is being tracked as 2021012842001309.

WORKAROUND:

MODIFICATION HISTORY:

• 2021-03-22: Initial Publication.

RELATED LINKS:

• CVE-2021-21437 at cve.mitre.org
• https://otrs.com/release-notes/otrs-security-advisory-2021-07/

CVSS SCORE:

3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

RISK LEVEL:

LOW

ACKNOWLEDGEMENTS:

Jaroslav Balaz