CVE-2021-21440 Support Bundle includes S/Mime and PGP keys

Medium 5.2 Published 26 Jul 2021 Updated 16 Sep 2024

Attackers can obtain private S/MIME and PGP keys from generated support bundles if the containing folder is not hidden.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-21440?

CVE-2021-21440 is a medium-severity vulnerability in Otrs Otrs, published on 26 Jul 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.

Weakness: CWE-200

Which versions are affected by CVE-2021-21440?

It affects 1 product.

Products include Otrs Otrs.

How do I fix CVE-2021-21440?

Upgrade to a fixed version.

Is CVE-2021-21440 being exploited?

There is no known exploitation of CVE-2021-21440 in the wild and no public exploit code.

All Otrs Otrs vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-21440, GHSA-g64f-vq5j-47gq, UBUNTU-CVE-2021-21440.