CVE catalog
CVE-2021-21441
znuny: CVE-2021-21441
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.09% · Oct 25, 2026
There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any user intraction. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | znuny | sid | 6.5.26-1 | not affected |
| Debian | znuny | forky | 6.5.26-1 | not affected |
| Debian | znuny | trixie | 6.5.15-2 | not affected |
| Debian | znuny | bookworm | 6.5.1-1 | not affected |
| Ubuntu | otrs2 | 16.04 | 4.0.10-1 | vulnerable |
| Ubuntu | otrs2 | 16.04 | 5.0.1-1 | vulnerable |
| Ubuntu | otrs2 | 16.04 | 5.0.1-2 | vulnerable |
| Ubuntu | otrs2 | 16.04 | 5.0.2-1 | vulnerable |
| Ubuntu | otrs2 | 16.04 | 5.0.3-1 | vulnerable |
| Ubuntu | otrs2 | 16.04 | 5.0.5-1 | vulnerable |
| Ubuntu | otrs2 | 16.04 | 5.0.6-1 | vulnerable |
| Ubuntu | otrs2 | 16.04 | 5.0.7-1 | vulnerable |
| Ubuntu | otrs2 | 18.04 | 5.0.23-1 | vulnerable |
| Ubuntu | otrs2 | 18.04 | 5.0.24-1 | vulnerable |
| Ubuntu | otrs2 | 18.04 | 6.0.1-1 | vulnerable |
| Ubuntu | otrs2 | 18.04 | 6.0.2-1 | vulnerable |
| Ubuntu | otrs2 | 18.04 | 6.0.3-1 | vulnerable |
| Ubuntu | otrs2 | 18.04 | 6.0.4-1 | vulnerable |
| Ubuntu | otrs2 | 18.04 | 6.0.5-1 | vulnerable |
| Ubuntu | otrs2 | 20.04 | 6.0.20-1 | vulnerable |
| Ubuntu | otrs2 | 20.04 | 6.0.23-2 | vulnerable |
| Ubuntu | otrs2 | 20.04 | 6.0.24-1 | vulnerable |
| Ubuntu | otrs2 | 20.04 | 6.0.25-1 | vulnerable |
| Ubuntu | otrs2 | 20.04 | 6.0.25-2 | vulnerable |
| Ubuntu | otrs2 | 20.04 | 6.0.25-3 | vulnerable |
| Ubuntu | otrs2 | 20.04 | 6.0.26-1 | vulnerable |
| Ubuntu | otrs2 | 22.04 | 6.0.32-6 | vulnerable |
| Ubuntu | otrs2 | 22.04 | 6.1.2-1 | vulnerable |
| Ubuntu | otrs2 | 22.04 | 6.2.1-1 | vulnerable |
| Ubuntu | otrs2 | 22.04 | 6.2.2-2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | znuny | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | znuny | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | znuny | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | znuny | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-21441]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-21441]
- [https://security-tracker.debian.org/tracker/CVE-2021-21441]
- [https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2023-2219.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]