CVE-2023-0265

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fluidattacks.com/advisories/supply/	Exploit Third Party Advisory
https://github.com/uvdesk/community-skeleton	Product
https://fluidattacks.com/advisories/supply/	Exploit Third Party Advisory
https://github.com/uvdesk/community-skeleton	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:uvdesk:community-skeleton:1.1.1:*:*:*:*:*:*:*

History

21 Nov 2024, 07:36

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-04-04 22:15

Updated : 2025-02-13 17:15

NVD link : CVE-2023-0265

Mitre link : CVE-2023-0265

CVE.ORG link : CVE-2023-0265

JSON object : View

Products Affected

uvdesk

community-skeleton

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2023-0265", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-04-04T22:15:07.217", "references": [{"url": "https://fluidattacks.com/advisories/supply/", "tags": ["Exploit", "Third Party Advisory"], "source": "help@fluidattacks.com"}, {"url": "https://github.com/uvdesk/community-skeleton", "tags": ["Product"], "source": "help@fluidattacks.com"}, {"url": "https://fluidattacks.com/advisories/supply/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/uvdesk/community-skeleton", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers."}], "lastModified": "2025-02-13T17:15:54.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uvdesk:community-skeleton:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C159BF6D-AB94-485F-AB26-2717FDAC0752"}], "operator": "OR"}]}], "sourceIdentifier": "help@fluidattacks.com"}