Harrison Daley

A HTML Injection issue was identified that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket.

A hidden field manipulation issue was identified that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and modified by using a proxy. The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.