osTicket Form Field Modification File Upload Size Restriction Bypass

medium Nessus Plugin ID 13646

Language:

Synopsis

It is possible to DoS the remote host through a wep application.

Description

The target is running at least one instance of osTicket that enables a remote user to a open new ticket with an attachment of unlimited size. An attacker could exploit this vulnerability and cause a denial of service by filling up the filesystem used for attachments.

Solution

Upgrade to osTicket STS 1.2.7 or later.

Plugin Details

Severity: Medium

ID: 13646

File Name: osticket_large_attachment_upload.nasl

Version: 1.17

Type: remote

Family: CGI abuses

Published: 7/14/2004

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

Required KB Items: www/osticket

Vulnerability Publication Date: 6/22/2004

Reference Information

CVE: CVE-2004-0614

Detections

Analytics