CVE-2021-21440
Assigner: OTRS
Published: 2021-07-26T00:00:00
State: PUBLISHED
title: Support Bundle includes S/Mime and PGP keys
datePublic: 2021-07-26T00:00:00
descriptions: value: Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.
affected: vendor: OTRS AG
product: ((OTRS)) Community Edition
versions: version: 6.0.1
status: affected
lessThan: 6.0.x*
versionType: custom
vendor: OTRS AG
product: OTRS
versions: version: 7.0.x
status: affected
lessThanOrEqual: 7.0.27
versionType: custom
version: 8.0.x
status: affected
lessThanOrEqual: 8.0.14
versionType: custom
credits: value: Julian Droste
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-200 Information Exposure
cweId: CWE-200
x_generator: engine: Vulnogram 0.0.9
source: advisory: OSA-2021-10
defect: 2021050342000331
discovery: USER
solutions: value: Update to OTRS 8.0.15 or OTRS 7.0.28.