CVE-2022-32074

MediumCVSS 5.4

Published: 13/07/2022(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.39%

69th percentile - higher than 69% of all known CVEs

Summary

A stored XSS vulnerability was found in osTicket-plugins Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae in the audit/class.audit.php component. Attackers can execute arbitrary web scripts or HTML via a crafted SVG file.

Risk Assessment

The risk involves potential execution of malicious scripts in administrators' or users' browsers, leading to session hijacking, defacement, or data leakage.

Recommendation

Immediately update the Storage-FS plugin to a version containing commit a7842d494889fd5533d13deb3c6a7789768795ae or later.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.