CVE-2020-16193: XSS
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-16193?
CVE-2020-16193 is a vulnerability in osTicket before version 1.14.3 that allows cross-site scripting (XSS) attacks.
How does CVE-2020-16193 affect osTicket?
CVE-2020-16193 affects osTicket versions prior to 1.14.3 by allowing an unvalidated echo $info['notes'] call in the include/staff/banrule.inc.php file, which can lead to XSS attacks.
What is the severity of CVE-2020-16193?
The severity of CVE-2020-16193 is medium, with a CVSS score of 5.4.
How can I fix CVE-2020-16193?
To fix CVE-2020-16193, it is recommended to upgrade osTicket to version 1.14.3 or later.
Where can I find more information about CVE-2020-16193?
You can find more information about CVE-2020-16193 in the references provided: [GitHub - osTicket banrule.inc.php](https://github.com/osTicket/osTicket/blob/develop/include/staff/banrule.inc.php#L67) and [GitHub - osTicket pull request](https://github.com/osTicket/osTicket/pull/5616/commits/fb570820ef1138776f929a179906e1d8089179d9).