GHSA-2hw6-4rv9-82fp

ghsaUSosv

Uvdesk remote code execution vulnerability

view advisory published 2023-04-05Licence: CC-BY-4.0

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-0265US	high8.8	1.60% (76th)	—	2023-04-04
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures…

references

External citations — patches, advisories, analysis.

https://fluidattacks.com/advisories/supplyWEB
https://github.com/uvdesk/community-skeletonPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-0265ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan