PT-2025-23258 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-05-30 · CVE-2025-48489

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:H/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The issue is related to Cross-Site Scripting (XSS) attacks due to insufficient data validation and sanitization during data reception. This allows attackers to execute malicious scripts on the application. The problem has been patched in version 1.8.180.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider implementing additional data validation and sanitization measures to minimize the risk of exploitation. Restrict access to sensitive areas of the application until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06965

CVE-2025-48489

GHSA-JQJF-F566-485J

Affected Products

Freescout

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48489.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqjf-f566-485j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48489 · Security Note
• https://bdu.fstec.ru/vul/2025-06965 · Security Note
• https://twitter.com/CVEnew/status/1928343314828263674 · Twitter Post
• https://t.me/cvetracker/24983 · Telegram Post