Description
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
uvdesk core-framework
Default version status: unaffected
0 to < 1.1.7affected1.1.7unaffected
pkg:composer/uvdesk/core-frameworkuvdesk community-skeleton
Default version status: unaffected
0 to < 1.1.8affected1.1.8unaffected
pkg:composer/uvdesk/community-skeletonReferences
- https://github.com/uvdesk/core-framework/commit/de0422869708eb17a54bf6a98166abb80c0d483d ↗
- https://github.com/uvdesk/core-framework/blob/v1.1.6/Services/TicketService.php#L1752-L1759 ↗
- https://github.com/uvdesk/core-framework/blob/v1.1.6/Controller/TicketXHR.php#L838-L850 ↗
- https://hackmd.io/@leediay/B1Cz5voFGg ↗
- https://github.com/uvdesk/core-framework/releases/tag/v1.1.7 ↗
- https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8 ↗
- https://github.com/uvdesk/core-framework ↗
- https://www.vulncheck.com/advisories/uvdesk-core-framework-before-1.1.7-authorization-bypass-via-saved-reply ↗