CVE-2010-0606: XSS
Published Feb 11, 2010
·Updated
Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.
Affected Software
15 affected components
osTicket osTicket=1.6-rc1
osTicket osTicket<=1.6
osTicket osTicket=1.6-rc3
osTicket osTicket=1.2.7
osTicket osTicket=1
osTicket osTicket=1.6-rc4
osTicket osTicket=1.6-rc2
osTicket osTicket=1.3.0
Enhancesoft osTicket<=1.6
Enhancesoft osTicket=1.2.7
Enhancesoft osTicket=1.3.0
Enhancesoft osTicket=1.6-rc1
Enhancesoft osTicket=1.6-rc2
Enhancesoft osTicket=1.6-rc3
Enhancesoft osTicket=1.6-rc4
Remediation
Patch Available
Event History
Feb 11, 2010
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-0606?
CVE-2010-0606 has a moderate severity rating due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2010-0606?
To fix CVE-2010-0606, update to osTicket version 1.6.0 Stable or later.
3
Which versions of osTicket are affected by CVE-2010-0606?
CVE-2010-0606 affects osTicket versions prior to 1.6.0 Stable, including multiple release candidates.
4
What type of vulnerability is CVE-2010-0606?
CVE-2010-0606 is classified as a cross-site scripting (XSS) vulnerability.
5
Can CVE-2010-0606 be exploited by unauthenticated users?
No, CVE-2010-0606 can only be exploited by authenticated users due to its access requirements.