VulnerabilityModified
CVE-2023-1724
Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application.
MEDIUM 5.4EPSS 0.47%
Does this matter?
Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.
Description
Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.47% probability · 39th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ladybirdweb/faveo helpdesk
- Source
- help@fluidattacks.com
References
- https://fluidattacks.com/advisories/towers/Exploit, Third Party Advisory
- https://github.com/ladybirdweb/faveo-helpdesk/Product
- https://fluidattacks.com/advisories/towers/Exploit, Third Party Advisory
- https://github.com/ladybirdweb/faveo-helpdesk/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.