CVE-2021-36097 - Agents are able to lock the ticket without the "Owner" permission

Back Back to CVE browser

MEDIUM

Agents are able to lock the ticket without the "Owner" permission

Published Oct 18, 2021

4.3

MEDIUM

CVSS 3.1

EPSS 0.52%

Description

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

Affected products

Vendor Otrs AG Product OTRS Default
unknown
Affected
- ≥ 8.0.x, ≤ 8.0.16

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Otrs AG	OTRS	unknown	Affected ≥ 8.0.x, ≤ 8.0.16

Remediation

Vendor solution

Update to OTRS 8.0.17.

Weaknesses (1)

CWE-266

Incorrect Privilege Assignment

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-22729
Advisory
https://otrs.com/release-notes/otrs-security-advisory-2021-20/
x_refsource_CONFIRMRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-22729		Advisory
https://otrs.com/release-notes/otrs-security-advisory-2021-20/		x_refsource_CONFIRMRelease NotesVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner OTRS

Published Oct 18, 2021

Updated Sep 16, 2024

Reserved Jul 1, 2021

Link CVE-2021-36097

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-36097

Red Hat

No data

ENISA EUVD

Assigner OTRS

Published Oct 18, 2021

Updated Sep 16, 2024

Link EUVD-2021-22729

GitHub

No data