TI-2021-14541 Aliases CVE-2021-36091 GHSA-mxpc-p9xr-9j86

Unautorized access to the calendar appointments

LOW 21CWE-200Published 2021-07-26 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200 and CWE-863.

Summary

Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.

Why it matters now

EPSS 0.00698 53rd percentileScored 2026-11-07

Fix Fixed OTRS (OTRS AG): 7.0.27

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OTRS AG	((OTRS)) Community Edition	6.0.1 and later	—	No fix listed	CNA
OTRS AG	OTRS	7.0.x to before 7.0.27	7.0.27	Patch available	CNA

((OTRS)) Community Edition VendorOTRS AG Affected 6.0.1 and later Fixed in — No fix listed CNA
OTRS VendorOTRS AG Affected 7.0.x to before 7.0.27 Fixed in 7.0.27 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:otrs:otrs:::::community:::*	6.0.0 to before 6.0.32	Vulnerable	OTRS AG
cpe:2.3:a:otrs:otrs::::::::	7.0.0 to before 7.0.28	Vulnerable	OTRS AG

cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:* Versions 6.0.0 to before 6.0.32 Vulnerable ·OTRS AG
cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.28 Vulnerable ·OTRS AG

Remediation

Fix · CNA OTRS (OTRS AG) Fixed in 7.0.27

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-07-26
OTRS ((OTRS)) Community Edition 6.0.x*
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2021-14542 XSS attack using special link in emailPriority LOW 30
- TI-2021-04538 Support Bundle includes S/Mime and PGP keysPriority LOW 30
- TI-2021-04541 Unautorized listing of the customer user emailsPriority LOW 22
Show all 4 records →
Release · 2021-07-26
OTRS 7.0.27
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-04541 Unautorized listing of the customer user emailsPriority LOW 22
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-36091
2026-10-03 Alias added: GHSA-mxpc-p9xr-9j86

References

Advisory 1

https://otrs.com/release-notes/otrs-security-advisory-2021-14/

Other 1

[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update

TI-2017-12458 In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS… CVSS 3.0HIGH 8.8
TI-2026-35608 SQL Injection via MySQL Quote Method CVSS 3.1CRITICAL 9.1
TI-2023-04991 SSL Certificates are not checked for E-Mail Handling CVSS 3.1CRITICAL 9.1
TI-2022-04045 SQL Injection via OTRS Search API CVSS 3.1CRITICAL 9.8
TI-2017-12258 Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5… CVSS 3.0HIGH 8.8
TI-2017-06753 In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x… CVSS 3.0HIGH 8.8

See all 141 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences