The vulnerability in Open ISES Tickets prior to version 3.44.2 involves disabling TLS certificate verification by setting CURLOPT_SSL_VERIFYPEER to false and not setting CURLOPT_SSL_VERIFYHOST in ajax/reports.php. This occurs during outbound HTTPS requests to the Google Maps Directions API for incident report generation. As a result, an attacker on the network path can perform man-in-the-middle attacks by presenting forged certificates, enabling interception or modification of requests and responses, including sensitive data in transit.

An attacker positioned between the server and the remote endpoint can intercept, monitor, or alter HTTPS requests and responses due to disabled certificate verification. This can lead to exposure or compromise of API keys and session-related data transmitted during incident report generation. The CVSS 4.0 score of 8.2 reflects a high severity impact with network attack vector and high vulnerability confidence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in Open ISES Tickets version 3.44.2, upgrading to this or a later version is recommended once available. Until then, consider restricting network access or using network-level protections to prevent man-in-the-middle attacks on affected servers.