CVE-2019-11537
MediumCVSS 6.1Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
In osTicket before version 1.12, an XSS vulnerability exists via uploading a crafted CSV file to the User Importer. File contents can appear in an error message, allowing script execution in the browser. This can lead to local file inclusion.
Risk Assessment
An attacker with agent privileges can exploit XSS to steal sessions, take over accounts, or perform arbitrary actions in the victim's context. This may result in sensitive data leakage or privilege escalation.
Recommendation
Upgrade osTicket to version 1.12 or later immediately. Additionally, restrict user import permissions and validate uploaded CSV files.
Original NVD description (English source)
In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.