What is GHSA-f4h3-3557-hgpp?

GHSA-f4h3-3557-hgpp is a security advisory published by GitHub Security Advisories with Medium severity. osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in...

Which CVE IDs does GHSA-f4h3-3557-hgpp cover?

GHSA-f4h3-3557-hgpp covers the following CVE IDs: CVE-2020-24917. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f4h3-3557-hgpp?

GHSA-f4h3-3557-hgpp has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-f4h3-3557-hgppMediumCVSS 6.1

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in...

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

July 10, 2026

🔗 CVE IDs covered (1)

CVE-2020-24917 →

📋 Description

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-24917
https://github.com/osTicket/osTicket/commit/518de223933eab0c5558741ce317f36958ef193d
https://github.com/osTicket/osTicket/compare/v1.14.2...v1.14.3
https://sisl.lab.uic.edu/projects/chess
https://sisl.lab.uic.edu/projects/chess/osticket-xss
https://github.com/advisories/GHSA-f4h3-3557-hgpp