PT-2023-16124 · Uvdesk · Uvdesk

Carlos Bello · Published 2023-04-04 · Updated 2023-04-11 · CVE-2023-0265

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Uvdesk version 1.1.1

Description The issue allows an authenticated remote attacker to execute commands on the server due to improper validation of profile pictures uploaded by customers.

Recommendations For Uvdesk version 1.1.1, consider disabling the profile picture upload feature until a patch is available to prevent command execution on the server. Restrict access to the server to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-0265

GHSA-2HW6-4RV9-82FP

Affected Products

Uvdesk

References · 7

• 🔥 https://fluidattacks.com/advisories/supply · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0265 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0265 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hw6-4rv9-82fp · Vendor Advisory
• https://github.com/uvdesk/community-skeleton · Note
• https://t.me/cvenotify/47534 · Telegram Post
• https://t.me/cvenotify/48012 · Telegram Post