medium

<strong>osTicket installer source check (CVE-2019-14750)</strong>

Older osTicket releases contain stored XSS in the installer workflow. Authorized GitHub scans identify source evidence without browser execution.

CVE-2019-14750CWE-79

Vaikutus

CVE-2019-14750 affects osTicket before 1.10.7 and 1.12.x before 1.12.1 [S1]. This is stored XSS (CWE-79) requiring user interaction [S1].

Syy ja näyttö

The installer stored administrator names without safe encoding; the upstream fix adds encoding [S2]. Release notes confirm the correction [S3] [S4].

Korjaus

Upgrade to 1.10.7, 1.12.1, or a supported release [S3] [S4], apply the upstream fix [S2], and restrict installer access.

FixVibe

Authorized GitHub scans report related source evidence as a high-confidence Likely issue. FixVibe does not submit forms, log in, render stored content, or execute JavaScript; repository evidence does not prove deployment or exploitability.