Description
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
uvdesk support-center-bundle
Default version status: unaffected
0 to < 1.1.3.3affected1.1.3.3unaffected
pkg:composer/uvdesk/support-center-bundleuvdesk community-skeleton
Default version status: unaffected
0 to < 1.1.8affected1.1.8unaffected
pkg:composer/uvdesk/community-skeletonReferences
- https://github.com/uvdesk/support-center-bundle/commit/3fa884a3adf0f317f354f83a1f9fa531234a551f ↗
- https://hackmd.io/@leediay/idor-rate-ticket_uvdesk ↗
- https://github.com/uvdesk/support-center-bundle ↗
- https://www.vulncheck.com/advisories/uvdesk-support-center-bundle-before-1.1.3.3-idor-via-rateticket-ticket-rating-endpoint ↗