PT-2025-23249 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-05-30 · CVE-2025-48483

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The issue is related to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitization. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Additionally, if an administrator accesses one of these emails with a modified signature, it could result in a subsequent Cross-Site Request Forgery (CSRF) vulnerability.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to mail signatures or disabling the feature that allows users to modify their signatures until the update is applied. Avoid using the application's mail signature feature with untrusted input until the issue is resolved.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

BDU:2025-06959

CVE-2025-48483

GHSA-G2VQ-QWX2-PC2M

Affected Products

Freescout

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48483.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-g2vq-qwx2-pc2m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48483 · Security Note
• https://bdu.fstec.ru/vul/2025-06959 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48483 · Vendor Advisory
• https://t.me/cvetracker/24971 · Telegram Post
• https://twitter.com/CVEnew/status/1928319519103369245 · Twitter Post