CVE-2021-21442: Otrs Time Accounting

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19.

Affected products

• Otrs Time Accounting: from 7.0.0, before 7.0.20 (fixed in 7.0.20)

Published 2021-07-26. Last modified 2026-06-17.