CVE-2023-30082

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-14 · updated 2026-06-17
Weakness: CWE-1284

Description

A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.

Affected products

osticket/osticket: 1.17.2

References

https://blog.manavparekh.com/2023/06/cve-2023-30082.html
https://github.com/manavparekh/CVEs/blob/main/CVE-2023-30082/Steps%20to%20reproduce.txt
https://blog.manavparekh.com/2023/06/cve-2023-30082.html
https://github.com/manavparekh/CVEs/blob/main/CVE-2023-30082/Steps%20to%20reproduce.txt

Get alerted when CVE-2023-30082 or the next vulnerability affects your stack