low3.5
CVE-2021-21443
Agents are able to list customer user emails without required permissions in the bulk action screen.
Impact
Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Otrs | Otrs | from 6.0.0 through 6.0.32 from 7.0.0 through 7.0.27 |