GHSA-fwhv-9phj-wrj5
Uvdesk vulnerable to stored cross-site scripting (XSS)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | uvdesk/community-skeleton | <= 1.1.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.
References
External links from the advisory. They lead to third-party sites.