CVE-2025-0972

Summary

A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.

Affected Software

VendorProductVersion RangeStatus
ZenviaMovidesk25.01.0affected
ZenviaMovidesk25.01.1affected
ZenviaMovidesk25.01.2affected
ZenviaMovidesk25.01.3affected
ZenviaMovidesk25.01.4affected
ZenviaMovidesk25.01.5affected
ZenviaMovidesk25.01.6affected
ZenviaMovidesk25.01.7affected
ZenviaMovidesk25.01.8affected
ZenviaMovidesk25.01.9affected
ZenviaMovidesk25.01.10affected
ZenviaMovidesk25.01.11affected
ZenviaMovidesk25.01.12affected
ZenviaMovidesk25.01.13affected
ZenviaMovidesk25.01.14affected
ZenviaMovidesk25.01.15affected
ZenviaMovidesk25.01.16affected
ZenviaMovidesk25.01.17affected
ZenviaMovidesk25.01.18affected
ZenviaMovidesk25.01.19affected
ZenviaMovidesk25.01.20affected
ZenviaMovidesk25.01.21affected
ZenviaMovidesk25.01.22affected

Weaknesses

  • CWE-79: Cross Site Scripting
  • CWE-94: Code Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References