Vulnerability · Published Jun 14, 2021 · Assigned by OTRS
CVE-2021-21439Possible DoS attack using a special crafted URL in email body
Medium 6.5
In plain English
A medium-severity security flaw in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions; 8.0.x version 8.0.13 and prior versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2021-21439 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | ((OTRS)) Community Edition | 6.0.1 – before 6.0.x* |
| OTRS AG | OTRS | 7.0.x – through 7.0.268.0.x – through 8.0.13 |
Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H