CVE-2026-102372

GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.

Analysis

AI-generated

Technical impact

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies processed by the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.

Affected Systems

GestSup (GestSup) application, all releases before 3.2.61, as documented by the vendor’s changelog and patch releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating moderate risk. The EPSS score is <1%, suggesting a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated email sent to the mailbox monitored by the IMAP connector; the exploit requires only the ability to inject an email and a technician to open the resulting ticket.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to GestSup 3.2.62 or later to obtain the fixed sanitization logic
  • If upgrading is not feasible, disable the IMAP LOGIN connector or block inbound emails to the monitored mailbox until the patch is applied
  • Implement a validation step that escapes or removes HTML content from email bodies before storing them in tickets as a temporary measure

Generated by OpenCVE AI on September 30, 2026 at 13:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions. GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
Title GestSup before 3.2.62 Stored XSS via Email Body in LOGIN IMAP Connector GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
Title GestSup before 3.2.62 Stored XSS via Email Body in LOGIN IMAP Connector
First Time appeared Gestsup
Gestsup gestsup
Weaknesses CWE-79
CPEs cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*
Vendors & Products Gestsup
Gestsup gestsup
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Sep 30, 2026, 11:15 AM
Reserved
Sep 28, 2026, 11:57 PM

View source JSON

Updated
Sep 29, 2026, 5:36 PM

JSON

Status
Deferred
Published
Sep 29, 2026, 1:16 AM
Modified
Sep 30, 2026, 5:32 PM

View source JSON

No data.

Updated
Sep 30, 2026, 1:15 PM

JSON