CVE-2021-21443: 
Linux Debian vulnerability analysis and mitigation

CVE-2021-21443 is a security vulnerability discovered in OTRS (Open Ticket Request System) that allows agents to list customer user emails without required permissions in the bulk action screen. The vulnerability was disclosed on July 26, 2021, affecting OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions, as well as OTRS AG OTRS 7.0.x versions prior to 7.0.27 (Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 3.5 LOW with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction to exploit. The scope is unchanged, with low confidentiality impact and no impact on integrity or availability (Vendor Advisory).

The vulnerability allows unauthorized access to customer email information through the bulk action screen, potentially leading to information disclosure. The impact is primarily focused on confidentiality, with no direct impact on system integrity or availability (Vendor Advisory).

The vulnerability requires an attacker to have network access and low-level privileges within the OTRS system. User interaction is required for successful exploitation, making it somewhat more difficult to exploit in real-world scenarios (Vendor Advisory).

The vulnerability has been fixed in OTRS version 7.0.28. Organizations using affected versions should upgrade to this version or later to mitigate the vulnerability. No alternative workarounds have been publicly documented (Vendor Advisory).