Spiizn

**Name of the Vulnerable Software and Affected Versions** GestSup versions prior to 3.2.62 **Description** Insufficient sanitization of HTML email bodies within the IMAP LOGIN connector allows unauthenticated attackers to perform a stored cross-site scripting attack. By sending emails to the monitored mailbox containing script tags and event handlers, attackers can inject arbitrary JavaScript into ticket descriptions and replies. This script executes in the browsers of technicians viewing the tickets, potentially leading to the theft of ticket data and the execution of unauthorized actions. **Recommendations** Update GestSup to version 3.2.62 or later.

**Name of the Vulnerable Software and Affected Versions** GestSup versions prior to 3.2.62 **Description** Authenticated attackers can read private comments from tickets belonging to other users without proper authorization. This occurs because the application fails to validate ticket ownership when loading comments through the 'thread.php' endpoint using the `threadedit` parameter. This flaw allows for the enumeration of sequential comment IDs to access unauthorized data. **Recommendations** Update GestSup to version 3.2.62 or later. As a temporary mitigation, restrict access to the 'thread.php' endpoint or avoid using the `threadedit` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** GestSup versions prior to 3.2.62 **Description** Stored cross-site scripting exists in the IMAP OAuth connector. The issue occurs because MIME-encoded email subjects are double-decoded after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes containing nested MIME encoded-words to inject JavaScript. This script executes within technician sessions when they view the associated tickets. **Recommendations** Update GestSup to version 3.2.62 or later.

**Name of the Vulnerable Software and Affected Versions** GestSup versions prior to 3.2.61 **Description** An issue exists in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails containing PHP attachments to monitored mailboxes. These files are then written to the web-accessible `upload/ticket` directory and can be executed upon access, leading to remote code execution. **Recommendations** Update GestSup to version 3.2.61 or later.