Skip to content
Heist/ feed
Medium

GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector

Type: advisorySource: Official CVE List1 source record

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.

Announced Source revision 1
Original source ↗

CVE-2026-102372

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102372

GestSup

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "GestSup",
    "product": "GestSup",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.2.61",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-102372

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#4176 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement