CVE-2020-24917

MediumCVSS 6.1

Published: 30/08/2020(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.22%

65th percentile - higher than 65% of all known CVEs

Summary

An XSS vulnerability in osTicket before version 1.14.3 allows an attacker to inject malicious script via a crafted filename uploaded to the _uploadInlineImage() function in include/ajax.draft.php.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, account takeover, or data leakage.

Recommendation

Immediately upgrade osTicket to version 1.14.3 or later, which includes a fix for the XSS vulnerability.

Original NVD description (English source)

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.