CVE-2023-0265

Summary

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.

Affected Software

Weaknesses

• Insecure file upload

ADP Enrichment

CVE Program Container

Additional References

• https://fluidattacks.com/advisories/supply/
• https://github.com/uvdesk/community-skeleton

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

References

• https://fluidattacks.com/advisories/supply/
• https://github.com/uvdesk/community-skeleton

• ←Previous
• Next→