PT-2025-23248 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-06-04 · CVE-2025-48482

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The issue is related to a mass assignment vulnerability in the Customer object, which is updated using the fill() method. This method processes fields such as channel and channel id, but it is called with all client-provided data, including unexpected values for these fields, leading to the vulnerability.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting the use of the fill() method to prevent mass assignment until the patch is applied. Avoid using unexpected values for channel and channel id in the affected object until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-841

Related Identifiers

BDU:2025-06958

CVE-2025-48482

GHSA-7FJP-538Q-9VRF

Affected Products

Freescout

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48482.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-7fjp-538q-9vrf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48482 · Security Note
• https://bdu.fstec.ru/vul/2025-06958 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48482 · Vendor Advisory
• https://twitter.com/dailycve/status/1930316446539886935 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1928333980572561733 · Twitter Post
• https://t.me/cvetracker/24970 · Telegram Post