CVE-2021-21442

Name of the Vulnerable Software and Affected Versions OTRS AG Time Accounting versions prior to 7.0.19

Description The issue allows for the injection of malicious JS code into certain fields in the project create screen. This code may be executed in the Reporting screen.

Recommendations For versions prior to 7.0.19, update to version 7.0.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the Reporting screen and the project create screen to minimize the risk of exploitation. Avoid using the affected fields in the project create screen until the issue is resolved.