PT-2025-23255 · Freescout · Freescout

Published 2025-05-13 · Updated 2025-06-04 · CVE-2025-48485

Positive Technologies · (AI Summary)

CVSS v2.0

6.8

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description FreeScout is a free self-hosted help desk and shared mailbox. The application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data when an authenticated user updates the profile of an arbitrary customer.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to the customer profile update feature until the patch is applied. Avoid using the vulnerable feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06961

CVE-2025-48485

GHSA-556Q-W535-XXG8

Affected Products

Freescout

References · 9

• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-556q-w535-xxg8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06961 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48485 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48485 · Vendor Advisory
• https://twitter.com/CVEnew/status/1928343317583908953 · Twitter Post
• https://twitter.com/dailycve/status/1930298553982734480 · Twitter Post
• https://t.me/cvetracker/24979 · Telegram Post
• https://t.me/cvenotify/124111 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1928385172220621209 · Twitter Post