CVE-2021-36095

🗓️ 06 Sep 2021 13:15:27Reported by OTRSType

Malicious attacker can exploit "lost password" feature to reveal valid user logins in OTRS AG (OTRS) Community Edition 6.0.1 and later, and OTRS 7.0.x 7.0.28 and prior versions

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2021-36095	6 Sep 202118:40	–	circl
CNNVD	OTRS 授权问题漏洞	6 Sep 202100:00	–	cnnvd
CNVD	OTRS licensing issue vulnerability	8 Sep 202100:00	–	cnvd
Cvelist	CVE-2021-36095 User enumeration issue using "lost password" feature	6 Sep 202113:15	–	cvelist
Debian CVE	CVE-2021-36095	6 Sep 202113:15	–	debiancve
EUVD	EUVD-2021-22727	7 Oct 202500:30	–	euvd
NVD	CVE-2021-36095	6 Sep 202114:15	–	nvd
OpenVAS	OTRS Multiple Vulnerabilities (OSA-2021-17, OSA-2021-18)	7 Sep 202100:00	–	openvas
OSV	CVE-2021-36095	6 Sep 202114:15	–	osv
OSV	UBUNTU-CVE-2021-36095	6 Sep 202114:15	–	osv

NVD

Node

otrs otrsRange6.0.1≥community

otrs otrsRange7.0.0–7.0.29-

[
  {
    "product": "((OTRS)) Community Edition",
    "vendor": "OTRS AG",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.0.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "OTRS",
    "vendor": "OTRS AG",
    "versions": [
      {
        "lessThanOrEqual": "7.0.28",
        "status": "affected",
        "version": "7.0.x",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
otrs	www.otrs.com/release-notes/otrs-security-advisory-2021-18/

17 Jun 2026 03:58Current

5.1Medium risk

Vulners AI Score5.1

CVSS 25

CVSS 3.15.3

EPSS0.00913

cve-2021-36095 otrs ag otrs community edition security vulnerability lost password user logins