Security readout for executives and security teams
Plain-English summary
Open ISES Tickets versions before 3.44.2 can expose logged-in users to malicious links that run attacker-controlled JavaScript in their browsers. Successful exploitation requires an authenticated attacker and victim interaction. It could expose limited information or alter actions performed within the victim’s session, but it does not directly affect service availability.
Executive priority
Schedule remediation promptly through the normal patch cycle, with faster action for externally reachable or sensitive deployments. The vulnerability is moderate rather than emergency-level because exploitation needs authentication and user interaction, and no active exploitation is documented. Prioritize identifying older installations and upgrading them to 3.44.2 or later.
Technical view
CVE-2026-48228 is reflected cross-site scripting in patient_w.php. Unsanitized id and ticket_id GET values are inserted into an HTML form action, allowing JavaScript execution when a crafted response is rendered. CVSS 3.1 is 5.4: network-accessible, low complexity, low privileges required, user interaction required, changed scope, and low confidentiality and integrity impact.
Likely exposure
Exposure is likely limited to internet- or network-reachable Open ISES Tickets deployments running versions before 3.44.2. Exploitation requires an authenticated attacker to craft a request and persuade another user to render it. The supplied affected-version metadata is inconsistent, listing version "0" as unaffected, so deployed-version verification is important.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation. The attack depends on authentication and victim interaction, reducing immediacy. Risk increases where untrusted users have accounts, privileged staff follow attacker-controlled links, or the application handles sensitive ticket or patient-related information.
Researcher notes
The reported sink is the patient_w.php form action, reached through id and ticket_id GET parameters. CWE-79 applies. The vendor commit and 3.44.2 release are identified as patch evidence. The bundle’s structured affected-version entry conflicts with its description, so researchers should confirm version boundaries from the vendor changes without assuming additional affected releases.
Mitigation direction
- Upgrade Open ISES Tickets to version 3.44.2 or later.
- Review the vendor release notes and patch before deployment.
- Restrict application access to trusted networks until upgrading.
- Limit accounts and privileges available to untrusted users.
Validation and detection
- Inventory all Open ISES Tickets deployments and record their versions.
- Confirm every deployment runs version 3.44.2 or later.
- Verify patient_w.php safely encodes id and ticket_id in HTML attributes.
- Review web logs for unusual patient_w.php requests containing encoded script-like input.
- Test remediation in an authorized non-production environment without executing active payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-48228 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openises/tickets/releases/tag/v3.44.2CVE reference, VulnCheck · release-notes
- https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbffCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-patient-w-php-id-and-ticket-id-parametersCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.