Description
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
Published: 2026-09-29
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting that can run in technician browsers, enabling ticket data theft and unauthorized actions
Action: Patch
AI Analysis

Impact

GestSup versions prior to 3.2.62 fail to sanitize HTML email bodies processed by the IMAP LOGIN connector. Unauthenticated attackers can send an email to the monitored mailbox with script tags or event‑handler attributes, which are stored in ticket descriptions and replies. When technicians view the affected tickets, the browser executes the injected JavaScript, allowing the attacker to exfiltrate ticket data or perform unauthorized client‑side actions.

Affected Systems

GestSup (GestSup) application, all releases before 3.2.62, as documented by the vendor’s changelog and patch releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating moderate risk. The EPSS score is not provided, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is an unauthenticated email sent to the mailbox monitored by the IMAP connector; the exploit requires only the ability to inject an email and a technician to open the resulting ticket.

Generated by OpenCVE AI on September 29, 2026 at 02:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to GestSup 3.2.62 or later to obtain the fixed sanitization logic
  • If upgrading is not feasible, disable the IMAP LOGIN connector or block inbound emails to the monitored mailbox until the patch is applied
  • Implement a validation step that escapes or removes HTML content from email bodies before storing them in tickets as a temporary measure

Generated by OpenCVE AI on September 29, 2026 at 02:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
Title GestSup before 3.2.62 Stored XSS via Email Body in LOGIN IMAP Connector
First Time appeared Gestsup
Gestsup gestsup
Weaknesses CWE-79
CPEs cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*
Vendors & Products Gestsup
Gestsup gestsup
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Gestsup Gestsup
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-29T00:33:22.841Z

Reserved: 2026-09-28T23:57:26.491Z

Link: CVE-2026-102372

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-29T01:16:44.593

Modified: 2026-09-29T01:16:44.593

Link: CVE-2026-102372

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T02:30:10Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')