CVE-2017-15362

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS

published October 16, 2017

CVSS
—
EPSS
1%
Percentile
68.2
In the wild
Unconfirmed
What it is

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01210 · 68.2th percentile
Published
2017-10-16T01:00Z
EPSS history
Timeline
  • 16 OCT 01:00Z
    osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS
    cvelistv5