PT-2023-17193 · Unknown · Faveo Helpdesk Enterprise

Carlos Bello · Published 2023-06-24 · Updated 2023-06-30 · CVE-2023-1724

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Faveo Helpdesk Enterprise version 6.0.1

Description The issue allows an attacker with agent permissions to perform privilege escalation on the application due to a stored XSS vulnerability.

Recommendations For Faveo Helpdesk Enterprise version 6.0.1, consider restricting access to agent permissions to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the functionality that allows agents to input data that could be used for stored XSS may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-1724

Affected Products

Faveo Helpdesk Enterprise

References · 6

• 🔥 https://fluidattacks.com/advisories/towers · Exploit
• https://osv.dev/vulnerability/CVE-2023-1724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1724 · Security Note
• https://t.me/cvenotify/53377 · Telegram Post
• https://t.me/cvenotify/53000 · Telegram Post
• https://github.com/ladybirdweb/faveo-helpdesk · Note