Risk | High |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2019-14748 CVE-2019-14749 CVE-2019-14750 |
CWE-ID | CWE-434 CWE-74 CWE-79 |
Exploitation vector | Network |
Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. |
Vulnerable software Subscribe |
osTicket Other software / Other software solutions |
Vendor | osTicket.com |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU30830
Risk: Medium
CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2019-14748
CWE-ID:
CWE-434 - Unrestricted Upload of File with Dangerous Type
Exploit availability: Yes
DescriptionThe vulnerability allows a remote authenticated user to read and manipulate data.
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.
MitigationInstall update from vendor's website.
Vulnerable software versionsosTicket: 1.12
External linkshttp://packetstormsecurity.com/files/154003/osTicket-1.12-File-Upload-Cross-Site-Scripting.html
http://github.com/osTicket/osTicket/commit/33ed106b1602f559a660a69f931a9d873685d1ba
http://github.com/osTicket/osTicket/releases/tag/v1.10.7
http://github.com/osTicket/osTicket/releases/tag/v1.12.1
http://www.exploit-db.com/exploits/47224
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU30831
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2019-14749
Exploit availability: Yes
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected.
MitigationInstall update from vendor's website.
Vulnerable software versionsosTicket: 1.12
External linkshttp://packetstormsecurity.com/files/154004/osTicket-1.12-Formula-Injection.html
http://github.com/osTicket/osTicket/commit/99818486c5b1d8aa445cee232825418d6834f249
http://github.com/osTicket/osTicket/releases/tag/v1.10.7
http://github.com/osTicket/osTicket/releases/tag/v1.12.1
http://www.exploit-db.com/exploits/47225
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU30832
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2019-14750
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: Yes
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate to version 1.12.1.
Vulnerable software versionsosTicket: 1.12
External linkshttp://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
http://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
http://github.com/osTicket/osTicket/releases/tag/v1.10.7
http://github.com/osTicket/osTicket/releases/tag/v1.12.1
http://www.exploit-db.com/exploits/47226
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.