CVE-2014-4744: XSS
Published Jul 9, 2014
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php.
Affected Software
37 affected components
Enhancesoft osTicket=1.8.0
Enhancesoft osTicket=1.8.0-rc1
Enhancesoft osTicket=1.8.0-rc2
Enhancesoft osTicket=1.8.0.1
Enhancesoft osTicket=1.8.0.2
Enhancesoft osTicket=1.8.0.3
Enhancesoft osTicket=1.8.0.4
Enhancesoft osTicket=1.8.1-rc1
Enhancesoft osTicket=1.8.1.1
Enhancesoft osTicket=1.8.1.2
Enhancesoft osTicket=1.8.3
Enhancesoft osTicket=1.8.4
Enhancesoft osTicket=1.9.0
osTicket osTicket<=1.9.1
osTicket osTicket=1.0
osTicket osTicket=1.2.7
osTicket osTicket=1.3.0
osTicket osTicket=1.6-rc1
osTicket osTicket=1.6-rc2
osTicket osTicket=1.6-rc3
osTicket osTicket=1.6-rc4
osTicket osTicket=1.6-rc5
osTicket osTicket=1.6.0
osTicket osTicket=1.8.1
osTicket osTicket=1.8.1-developer_preview
Enhancesoft osTicket<=1.9.1
Enhancesoft osTicket=1.0
Enhancesoft osTicket=1.2.7
Enhancesoft osTicket=1.3.0
Enhancesoft osTicket=1.6-rc1
Enhancesoft osTicket=1.6-rc2
Enhancesoft osTicket=1.6-rc3
Enhancesoft osTicket=1.6-rc4
Enhancesoft osTicket=1.6-rc5
Enhancesoft osTicket=1.6.0
Enhancesoft osTicket=1.8.1
Enhancesoft osTicket=1.8.1-developer_preview
Remediation
Patch Available
Event History
Jul 9, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-4744?
CVE-2014-4744 is classified as a High severity vulnerability due to its impact on web application security.
2
How do I fix CVE-2014-4744?
To resolve CVE-2014-4744, you should upgrade to osTicket version 1.9.2 or later.
3
What types of attacks does CVE-2014-4744 allow?
CVE-2014-4744 allows remote attackers to perform Cross-Site Scripting (XSS) attacks.
4
Which versions of osTicket are affected by CVE-2014-4744?
CVE-2014-4744 affects osTicket versions prior to 1.9.2, including multiple versions of 1.8.x.
5
What are the vulnerable fields in CVE-2014-4744?
CVE-2014-4744 is vulnerable in the Phone Number and passwd fields in open.php and account.php.