MEDIUM6.1

GHSA-fwhv-9phj-wrj5

Uvdesk vulnerable to stored cross-site scripting (XSS)

Details

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/uvdesk/community-skeleton

Introduced in: 0

No fixed version published yet for uvdesk/community-skeleton (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-0325[ADVISORY]
https://fluidattacks.com/advisories/labrinth[WEB]
https://github.com/uvdesk/community-skeleton[WEB]