CVE-2021-21437: Otrs Itsmconfigurationmanagement

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions

Affected products

• Otrs Itsmconfigurationmanagement: from 7.0.0, up to and including 7.0.24
• Otrs Otrscisincustomerfrontend: from 7.0.0, up to and including 7.0.15

Published 2021-03-22. Last modified 2026-06-17.