CVE-2021-36091 Unautorized access to the calendar appointments

Low 3.5 Published 26 Jul 2021 Updated 16 Sep 2024

Agents can view calendar appointments without proper permissions, exposing sensitive scheduling data in OTRS systems.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-36091?

CVE-2021-36091 is a low-severity missing authorization vulnerability in Otrs Otrs, published on 26 Jul 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.

Weakness: CWE-863, CWE-200

Which versions are affected by CVE-2021-36091?

It affects 1 product.

Products include Otrs Otrs.

How do I fix CVE-2021-36091?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-36091 being exploited?

There is no known exploitation of CVE-2021-36091 in the wild and no public exploit code.

All Otrs Otrs vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-36091, GHSA-mxpc-p9xr-9j86, UBUNTU-CVE-2021-36091.