FreeScout stored admin XSS via failed-job details
If an admin opens a certain page, attackers can act with admin rights.
Summary
FreeScout is a self-hosted help desk and shared mailbox tool. Before 1.8.230, an unauthenticated attacker can plant a script through a failed-login email that runs with administrator rights when an administrator opens the job details page directly.
Affected when
- Logs Monitoring enabled for users
- A failed alert email job
- Queue failure storage in use
- Administrator opens the job details page as a top-level page
What to do
Update to version 1.8.230 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen