Risk | High |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2019-13397 CVE-2017-15580 CVE-2017-15362 |
CWE-ID | CWE-79 CWE-434 CWE-352 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #2 is available. |
Vulnerable software Subscribe |
osTicket Other software / Other software solutions |
Vendor | osTicket.com |
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU35737
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2019-13397
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsosTicket: 1.10.1
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU38020
Risk: High
CVSSv3.1:
CVE-ID: CVE-2017-15580
CWE-ID:
CWE-434 - Unrestricted Upload of File with Dangerous Type
Exploit availability: Yes
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.
MitigationInstall update from vendor's website.
Vulnerable software versionsosTicket: 1.10.1
http://0day.today/exploits/28864
http://nakedsecurity.com/cve/CVE-2017-15580/
http://becomepentester.blogspot.com/2017/10/osTicket-File-Upload-Restrictions-Bypassed-CVE-2017-15580.html
http://cxsecurity.com/issue/WLB-2017100187
http://packetstormsecurity.com/files/144747/osticket1101-shell.txt
http://www.cyber-security.ro/blog/2017/10/25/osticket-1-10-1-shell-upload/
http://www.exploit-db.com/exploits/45169/
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU38069
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2017-15362
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
MitigationInstall update from vendor's website.
Vulnerable software versionsosTicket: 1.10.1
http://becomepentester.blogspot.ae/2017/10/osTicket-XSS-CVE-2017-15362.html
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?