The vulnerability in GestSup before version 3.2.62 involves improper sanitization of HTML email bodies processed by the IMAP LOGIN connector. Attackers can send specially crafted emails containing script tags and event handlers that are stored in ticket descriptions and replies. When technicians view these tickets, the embedded JavaScript executes in their browsers, enabling theft of ticket data and unauthorized actions within the application context. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and limited confidentiality and integrity impact.

An unauthenticated attacker can inject and store malicious JavaScript in ticket data by sending crafted emails to the monitored mailbox. This script executes in the context of technician browsers, potentially leading to theft of sensitive ticket information and unauthorized actions performed on behalf of the technician user. The vulnerability impacts confidentiality and integrity but does not affect availability.

A fix is available in GestSup version 3.2.62. Users should upgrade to version 3.2.62 or later to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official patch.