HIGH8.8

GHSA-2hw6-4rv9-82fp

Uvdesk remote code execution vulnerability

Details

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/uvdesk/community-skeleton

Introduced in: 0

No fixed version published yet for uvdesk/community-skeleton (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-0265[ADVISORY]
https://fluidattacks.com/advisories/supply[WEB]
https://github.com/uvdesk/community-skeleton[PACKAGE]