Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OTRS ((OTRS)) Community Edition 6.0.x* Clear all filters
TI-2021-14542 CVE-2021-36092 · GHSA-r4rg-fqhp-766m

XSS attack using special link in email

Priority LOW 30

It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00717 Published 2021-07-26 No fix listed CWE-79
TI-2021-14541 CVE-2021-36091 · GHSA-mxpc-p9xr-9j86

Unautorized access to the calendar appointments

Priority LOW 21

Agents are able to list appointments in the calendars without required permissions.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00698 Published 2021-07-26 Fixed in 7.0.27 CWE-200
TI-2021-04541 CVE-2021-21443 · GHSA-8cr8-7h2h-c8f7

Unautorized listing of the customer user emails

Priority LOW 22

Agents are able to list customer user emails without required permissions in the bulk action screen.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00817 Published 2021-07-26 Fixed in 7.0.27 CWE-200
TI-2021-04538 CVE-2021-21440 · GHSA-g64f-vq5j-47gq

Support Bundle includes S/Mime and PGP keys

Priority LOW 30

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00789 Published 2021-07-26 No fix listed CWE-200