GHSA-fwhv-9phj-wrj5

ghsaUSosv

Uvdesk vulnerable to stored cross-site scripting (XSS)

view advisory published 2023-04-05Licence: CC-BY-4.0

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-0325US	medium6.1	0.69% (52nd)	—	2023-04-04
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the…

references

External citations — patches, advisories, analysis.

https://fluidattacks.com/advisories/labrinthWEB
https://github.com/uvdesk/community-skeletonWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-0325ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan