osTicky2 (com_osticky2) 2.2.8 and below - Unauthenticated Open Redirect via base64 return Parameter

osTicky2 (osTicket Bridge) by SmartCalc bridges a Joomla front end to an osTicket support system. Versions up to and including 2.2.8 let an attacker control the base64-encoded "return" parameter used to build the login redirect, so a crafted link on the site sends the visitor to an attacker-controlled destination after login. That is a credible phishing primitive because the malicious link starts on the trusted domain. CVSS 6.1 (Medium), no authentication required, but the victim must follow the link. The Joomla CNA records 2.2.8 as still affected and the extension has had no release since 2016, so there is no version to update to. osTicky2 is Joomla 3 only, which is itself end of life. Remove the extension. Note: the NVD description and CPE data instead read as "fixed in 2.2.8"; the CNA affected-products block (the vendor-supplied field, and the one this rule follows) says 2.2.8 is affected. Revisit if the vendor ever clarifies.

Affected versions: ≤ 2.2.8

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions