CVE-2021-36095 User enumeration issue using "lost password" feature
Attackers can enumerate valid user accounts via the lost password feature, exposing user identities in OTRS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36095?
CVE-2021-36095 is a medium-severity vulnerability in Otrs Otrs, published on 6 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
Which versions are affected by CVE-2021-36095?
It affects 1 product.
Products include Otrs Otrs.
How do I fix CVE-2021-36095?
No fix has been published for CVE-2021-36095 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-36095 being exploited?
There is no known exploitation of CVE-2021-36095 in the wild and no public exploit code.
Other vulnerabilities in Otrs Otrs
Sources
Also known as GHSA-mgr7-vch3-x89h, UBUNTU-CVE-2021-36095.