CVE-2020-22608

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12.6

Description The issue is related to a Cross Site Scripting vulnerability. It can be exploited via the queue-name parameter to the "/include/ajax.search.php" API endpoint.

Recommendations For versions prior to 1.12.6, update to version 1.12.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the /include/ajax.search.php API endpoint or avoiding the use of the queue-name parameter until the update is applied.