PT-2022-11576 · Osticket · Osticket

Published 2022-05-04 · Updated 2022-05-13 · CVE-2021-42235

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.14.8 osTicket versions prior to 1.15.4

Description The issue allows attackers to perform SQL injection in the login and password reset process, enabling them to access the administration profile functionality.

Recommendations For osTicket versions prior to 1.14.8, update to version 1.14.8 or later. For osTicket versions prior to 1.15.4, update to version 1.15.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-42235

Affected Products

Osticket

References · 4

• https://github.com/osTicket/osTicket/commit/e28291022e662ffa754e170c09cade7bdadf3fd9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-42235 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42235 · Vendor Advisory
• https://t.me/cibsecurity/41932 · Telegram Post