CVE-2017-15362

Published: Oct 16, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.

Affected (1)

Products: Osticket: Osticket

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Osticket Osticket	Version 1.10.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://becomepentester.blogspot.ae/2017/10/osTicket-XSS-CVE-2017-15362.html

Source: cve@mitre.org

Third Party Advisory

https://becomepentester.blogspot.ae/2017/10/osTicket-XSS-CVE-2017-15362.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.