A flaw in Open ISES Tickets < 3.44.2 disables TLS certificate verification when the server calls the Google Maps Directions API during incident report generation by setting CURLOPT_SSL_VERIFYPEER to false and leaving CURLOPT_SSL_VERIFYHOST undefined. This allows an attacker positioned on the network path between the ticketing server and the remote endpoint to present a forged certificate, thereby intercepting, monitoring or modifying the request and response, which can expose API keys, session data or other sensitive information in transit.

The vulnerability affects the Open ISES Tickets application, specifically all versions prior to 3.44.2. Any deployment running those earlier releases is susceptible to the described MITM attack.

The CVSS score of 8.2 reflects a high‑severity flaw, with the EPSS score not available but by implication the exploitation probability may be non‑negligible; the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to intercept traffic on the path between the ticketing server and Google’s servers, which typically means a network‑level attacker or compromised intermediary. Given the potential to tamper with API keys and session data, the impact spans confidentiality and integrity across the application and its communications.