PT-2023-16179 · Uvdesk · Uvdesk

Carlos Bello · Published 2023-04-04 · Updated 2023-04-11 · CVE-2023-0325

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Uvdesk version 1.1.1

Description The issue allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.

Recommendations For Uvdesk version 1.1.1, update the application to a version that correctly validates the message sent by the clients in the ticket to prevent stored XSS exploitation. As a temporary workaround, consider restricting the input validation for the message sent by the clients in the ticket to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0325

GHSA-FWHV-9PHJ-WRJ5

Affected Products

Uvdesk

References · 7

• 🔥 https://fluidattacks.com/advisories/labrinth · Exploit
• https://osv.dev/vulnerability/GHSA-fwhv-9phj-wrj5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0325 · Security Note
• https://github.com/uvdesk/community-skeleton · Note
• https://t.me/cvenotify/47533 · Telegram Post
• https://t.me/cvenotify/48013 · Telegram Post