Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-24881

86
FAUCET Score

CVE-2020-24881 describes a critical Server-Side Request Forgery (SSRF) vulnerability in osTicket versions prior to 1.14.3. This flaw allows an unauthenticated attacker to add malicious files to the server or conduct port scanning. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, the vulnerability poses a severe risk of complete compromise (confidentiality, integrity, and availability). While not listed in CISA's KEV catalog, public exploit code is available via ExploitDB and Nuclei templates, though there is limited community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.14.3CPE matchmatch criteria
cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
73.27%
Probability of exploitation in next 30 days
EPSS Percentile
99.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
Nuclei: CVE-2020-24881 · Nov 13, 2024
ExploitDB: EDB-49441 · Jan 19, 2021
This CVE's current EPSS score of 0.7327 is in the 98th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

github_advisorypatch availablevia nvd_reference
View patch

References

packetstormsecurity.com / files/160995/osTicket-1.14.2-Server-Side-Request-Forgery.html
ExploitThird Party AdvisoryVDB Entry
blackbatsec.medium.com / cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0
ExploitThird Party Advisory
github.com / osTicket/osTicket/commit/d98c2d096aeb8876c6ab2f88317cd371d781f14d
PatchThird Party Advisory