CVE-2017-15362: XSS
osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15362?
CVE-2017-15362 has a medium severity rating due to the potential for arbitrary client-side JavaScript code execution.
How do I fix CVE-2017-15362?
To fix CVE-2017-15362, upgrade to osTicket version 1.10.2 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2017-15362?
CVE-2017-15362 is classified as a Cross-Site Scripting (XSS) vulnerability.
What can attackers do with CVE-2017-15362?
Attackers can execute arbitrary JavaScript on victims' browsers, potentially leading to session ID theft and CSRF vulnerabilities.
Which version of osTicket is affected by CVE-2017-15362?
CVE-2017-15362 specifically affects osTicket version 1.10.1.