CVE-2021-21439 Possible DoS attack using a special crafted URL in email body
Attackers can cause high CPU usage or system halts in OTRS by sending emails with specially crafted URLs in the body.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21439?
CVE-2021-21439 is a medium-severity denial of service vulnerability in Otrs Otrs, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions; 8.0.x version 8.0.13 and prior versions.
Which versions are affected by CVE-2021-21439?
It affects 1 product.
Products include Otrs Otrs.
How do I fix CVE-2021-21439?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21439 being exploited?
There is no known exploitation of CVE-2021-21439 in the wild and no public exploit code.
Other vulnerabilities in Otrs Otrs
Sources
Also known as DEBIAN-CVE-2021-21439, GHSA-58p7-gj75-3437, UBUNTU-CVE-2021-21439.