CVE-2023-30082 Denial of service in n/a

High 7.5 Published 14 Jun 2023 Updated 6 Jan 2025

Attackers can crash the osTicket server by submitting excessively long passwords, causing resource exhaustion and service unavailability.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-30082?

CVE-2023-30082 is a high-severity denial of service vulnerability in n/a, published on 14 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.

Weakness: CWE-1284

Which versions are affected by CVE-2023-30082?

It affects 1 product.

Products include Enhancesoft Osticket.

How do I fix CVE-2023-30082?

No fix has been published for CVE-2023-30082 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-30082 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-30082 exists.

Sources

Also known as GHSA-r6x9-4x42-c57h.