PT-2026-102423 · Gestsup · Gestsup
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
GestSup versions prior to 3.2.62
Description
Stored cross-site scripting exists in the IMAP OAuth connector. The issue occurs because MIME-encoded email subjects are double-decoded after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes containing nested MIME encoded-words to inject JavaScript. This script executes within technician sessions when they view the associated tickets.
Recommendations
Update GestSup to version 3.2.62 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gestsup