Description
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GestSup GestSup
Default version status: unaffected
0 to < 3.2.62affected
References
- https://gestsup.fr/index.php?page=changelog ↗
- https://gestsup.fr/index.php?page=download ↗
- https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.62&type=patch ↗
- https://www.vulncheck.com/advisories/gestsup-before-3.2.62-stored-xss-via-double-decoded-email-subject-in-oauth-imap-connector ↗
- https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/ ↗