CVE-2021-36100: Specially crafted string in OTRS system configuration can allow the execution of any system command.

PriorityP354high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.30%

66.9th percentile

Specially crafted string in OTRS system configuration can allow the execution of any system command.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	otrs2	—	—
debian	znuny	—	—
otrs	otrs	< 7.0.28	7.0.28
otrs	otrs	>= 7.0.30 < 7.0.33	7.0.33
otrs	otrs	>= 8.0.0 < 8.0.21	8.0.21
otrs	otrs_itsm	< 7.0.19	7.0.19
otrs	otrs_itsm	>= 8.0.0 < 8.0.28	8.0.28
otrs	otrs_storm	< 8.0.12	8.0.12
otrs_ag	community_edition	>= 6.0.1 < 6.0.x*	6.0.x*
otrs_ag	otrs	7.0.x – 7.0.32	—
otrs_ag	otrs	8.0.x – 8.0.19	—
otrs_ag	otrsstorm	>= 6.0.1 < 6.0.x*	6.0.x*
otrs_ag	otrsstorm	7.0.x – 7.0.27	—
otrs_ag	otrsstorm	8.0.x – 8.0.11	—
otrs_ag	systemmonitoring	>= 6.0.1 < 6.0.x*	6.0.x*
otrs_ag	systemmonitoring	7.0.x – 7.0.18	—
otrs_ag	systemmonitoring	8.0.x – 8.0.8	—

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

osv8.8HIGH

vendor_debian6.4MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.