← Database

CVE-2021-36097

LOW CVSS: 3.5 Published: 2021-10-18 Modified: 2026-06-17

Description

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

Affected Platforms

Otrs Otrs

Weakness Type

CWE-266, NVD-CWE-noinfo

References