Description
A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
Exploits (1)
References (3)
Core 3
Core References
Third Party Advisory x_refsource_misc
https://owasp.org/www-community/attacks/xss/
Product, Third Party Advisory x_refsource_misc
https://github.com/osTicket/osTicket-plugins
Patch, Third Party Advisory x_refsource_misc
https://github.com/osTicket/osTicket-plugins/commit/a7842d494889fd5533d13deb3c6a7789768795ae
Scores
CVSS v3
5.4
EPSS
0.0097
EPSS Percentile
76.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
osticket/osticket
< 2022-05-19
Published
Jul 13, 2022
Tracked Since
Feb 18, 2026