Description
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
faveosuite faveo-helpdesk
Default version status: unaffected
0 to ≤ 2.0.3affected
pkg:github/faveosuite/faveo-helpdeskReferences
- https://hackmd.io/@hieuPenguinnn/faveo-helpdesk-ticket-tooltip-cross-department-idor ↗
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L2356-L2374 ↗
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/routes/web.php#L350 ↗
- https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-broken-access-control-via-ticket-tooltip-endpoint ↗