CVE-2021-21441 XSS in the ticket overview screens
Attackers can execute scripts via crafted emails in ticket overviews, potentially stealing data or taking over accounts without user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21441?
CVE-2021-21441 is a high-severity cross-site scripting vulnerability in Otrs Otrs, published on 16 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any user intraction. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions.
Weakness: CWE-79
Which versions are affected by CVE-2021-21441?
It affects 1 product.
Products include Otrs Otrs.
How do I fix CVE-2021-21441?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-21441 being exploited?
There is no known exploitation of CVE-2021-21441 in the wild and no public exploit code.
Other vulnerabilities in Otrs Otrs
Sources
Also known as DEBIAN-CVE-2021-21441, GHSA-jpp9-9j52-jc5j, UBUNTU-CVE-2021-21441.