FreeScout server can be made to request internal addresses
A customer support tool lets logged-in admins peek into internal servers.
Summary
Incomplete address checks in FreeScout let a logged-in administrator or a user with mailbox or module rights reach internal services through the server. Versions before 1.8.230 are affected, and no path for unauthenticated outsiders is established.
Affected when
- Logged-in administrator or user with mailbox or module settings rights
What to do
Update to 1.8.230 or later.
Products and platforms
CVE IDs
Times
First published
First seen