Unauthenticated Stored XSS in osTicket by osTicket Inc.
CVE-2019-13397

6.1MEDIUM

Key Information:

Vendor

Enhancesoft

Status
Osticket
Vendor
CVE Published:
9 July 2019

What is CVE-2019-13397?

An unauthenticated stored Cross-Site Scripting (XSS) vulnerability in osTicket version 1.10.1 enables remote attackers to inject arbitrary web scripts or HTML code. This can occur when the attacker creates a support ticket using a specially crafted file extension, leading to potential unauthorized administrative access.

References

https://medium.com/%40sarapremashish/osticket-1-10-1-unau...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.