CVE-2023-30082highCWE-1284

CVE-2023-30082

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
In short

The osTicket application crashes when someone submits an extremely long password (over 10 million characters), causing the website to stop working. The server wastes all its computing power trying to process this unusually large input.

Technical detail

A denial of service vulnerability exists in osTicket where supplying a password exceeding 10,000,000 characters causes excessive CPU and memory consumption, leading to service unavailability. The attack vector is unauthenticated and requires only submission of a maliciously crafted password during login or registration, with no special preconditions beyond network access to the application.

Summary generated and translated by AI from the official description.
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a