Cross-Site Scripting Vulnerability in osTicket by Enhancesoft
CVE-2018-7196

6.1MEDIUM

Key Information:

Vendor

Osticket

Status
Osticket
Vendor
CVE Published:
27 March 2018

What is CVE-2018-7196?

A vulnerability exists in osTicket prior to version 1.10.2 that permits remote attackers to exploit the application through the 'sort' parameter in /scp/index.php. This security flaw allows the injection of arbitrary web scripts or HTML, potentially leading to unauthorized actions taken on behalf of users or the exposure of sensitive information.

References

https://blog.securityevaluators.com/vulnerabilities-found...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.