CVE-2021-36097 LOW

CVE-2021-36097: Agents are able to lock the ticket without the "Owner" permission

Vendor Otrs Ag

Product OTRS

Weakness CWE-266

Published October 18, 2021

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

3.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

Key dates

02Disclosure timeline

October 18, 2021 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-36097 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/266.html

Related vulnerabilities

04Related CVE

CVE-2024-54365 WordPress KH Easy User Settings plugin <= 1.0.0 - Privilege Escalation vulnerability CVE-2025-69378 WordPress Product Filter for WooCommerce plugin <= 9.1.2 - Privilege Escalation vulnerability CVE-2022-20681 Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Catalyst 9000 Family Wireless Controllers Privilege Escalation Vulnerability CVE-2022-3826 Huaxia ERP Retail Management list information disclosure CVE-2025-55707 WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability