Executive brief
Open ISES Tickets, an open-source ticketing and incident management system, is vulnerable to a security flaw where malicious code can be executed in a user's browser. An attacker can send a specially crafted link to a logged-in user; if clicked, the attacker could potentially steal session information or perform actions on the user's behalf. This issue affects versions prior to 3.44.2 and could lead to unauthorized access to sensitive ticket data.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The flaw is located in 'do_unit_mail.php', where the 'the_ticket' GET parameter is insufficiently sanitized before being assigned directly to a JavaScript variable. An authenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes within the context of their browser session, potentially allowing for session hijacking or unauthorized data manipulation. The issue was addressed in version 3.44.2 by implementing proper integer validation (intval) on the affected parameter.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to GitHub repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-20: disclosed: CVE-2026-35015 published to NVD