Vulnerability Description
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Osticket | Osticket | < 1.10.7 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/154003/osTicket-1.12-File-Upload-Cross-SiteExploitThird Party AdvisoryVDB Entry
- https://github.com/osTicket/osTicket/commit/33ed106b1602f559a660a69f931a9d873685PatchRelease NotesThird Party Advisory
- https://github.com/osTicket/osTicket/releases/tag/v1.10.7Release NotesThird Party Advisory
- https://github.com/osTicket/osTicket/releases/tag/v1.12.1Third Party Advisory
- https://www.exploit-db.com/exploits/47224ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/154003/osTicket-1.12-File-Upload-Cross-SiteExploitThird Party AdvisoryVDB Entry
- https://github.com/osTicket/osTicket/commit/33ed106b1602f559a660a69f931a9d873685PatchRelease NotesThird Party Advisory
- https://github.com/osTicket/osTicket/releases/tag/v1.10.7Release NotesThird Party Advisory
- https://github.com/osTicket/osTicket/releases/tag/v1.12.1Third Party Advisory
- https://www.exploit-db.com/exploits/47224ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2019-14748?
CVE-2019-14748 is a vulnerability with a CVSS score of 5.4 (MEDIUM). An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality ha...
How severe is CVE-2019-14748?
CVE-2019-14748 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-14748?
Check the references section above for vendor advisories and patch information. Affected products include: Osticket Osticket.