osTicket vulnerabilities
3 known vulnerabilities in osTicket from Enhancesoft. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
osTicket: Weak Password Recovery Mechanism for Forgotten Password
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whet
- 7.5 High severity
osTicket: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filte
- 7.5 High severity
Osticket: Improper Validation of Specified Quantity in Input
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is enter