CVE-2019-11537

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user…

published April 25, 2019

CVSS
—
EPSS
5%
Percentile
91.7
In the wild
Unconfirmed
What it is

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04622 · 91.7th percentile
Published
2019-04-25T18:26Z
EPSS history
Timeline
  • 25 APR 18:26Z
    In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user…
    cvelistv5