CVE-2021-36096 Explained : Impact and Mitigation

This article provides detailed information about CVE-2021-36096, a vulnerability found in OTRS software.

Understanding CVE-2021-36096

CVE-2021-36096 is a security vulnerability that affects OTRS software, specifically ((OTRS)) Community Edition and OTRS versions 7.0.x and 8.0.x. The issue allows generated support bundles to include private S/MIME and PGP keys if the containing folder is not hidden.

What is CVE-2021-36096?

The vulnerability in CVE-2021-36096 enables the inclusion of private S/MIME and PGP keys in support bundles of OTRS software.

The Impact of CVE-2021-36096

The impact of this vulnerability is rated as medium severity with a CVSS base score of 5.2. It poses a high confidentiality impact and requires high privileges from the attacker.

Technical Details of CVE-2021-36096

CVE-2021-36096 has the following technical details:

Vulnerability Description

The vulnerability allows private S/MIME and PGP keys to be included in support bundles.

Affected Systems and Versions

((OTRS)) Community Edition 6.0.1 and later versions
OTRS 7.0.x versions up to 7.0.28
OTRS 8.0.x versions up to 8.0.15

Exploitation Mechanism

The attack complexity is low, with a required user interaction over a network. The attacker needs high privileges to exploit this vulnerability.

Mitigation and Prevention

To secure systems from CVE-2021-36096, follow these steps:

Immediate Steps to Take

Update OTRS to versions 8.0.16 or 7.0.29 to mitigate the vulnerability.

Long-Term Security Practices

Ensure that private keys are not exposed in support bundles and regularly update OTRS software.

Patching and Updates

Stay informed about security advisories and promptly apply patches released by OTRS AG to address vulnerabilities.