CVE-2020-24917

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php

published August 30, 2020

CVSS
—
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01225 · 68.6th percentile
Published
2020-08-30T15:45Z
EPSS history
Timeline
  • 30 AUG 15:45Z
    osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php
    cvelistv5