Freescout CVE-2024-1932

MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-02-28 security@huntr.dev

File Upload Freescout

4.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Feb 28, 2024 - 00:15 nvd

MEDIUM 4.8

DescriptionNVD

Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout

AnalysisAI

Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout Affected products include: Freescout.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Freescout

View all

CVE-2026-28289 CRITICAL Act Now POC

File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.

CVE-2026-27636 HIGH Act Now POC

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that

CVE-2026-27637 CRITICAL Act Now POC

Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers

CVE-2024-29185 CRITICAL Act Now POC

FreeScout is a self-hosted help desk and shared mailbox. Rated critical severity (CVSS 9.0), this vulnerability is remot

CVE-2024-29184 HIGH This Week POC

FreeScout is a self-hosted help desk and shared mailbox. Rated high severity (CVSS 8.0), this vulnerability is remotely

CVE-2024-28186 HIGH This Week POC

FreeScout is an open source help desk and shared inbox built with PHP. Rated high severity (CVSS 7.1), this vulnerabilit

CVE-2024-34698 MEDIUM This Month POC

FreeScout is a free, self-hosted help desk and shared mailbox. Rated medium severity (CVSS 6.3), this vulnerability is r

CVE-2024-34697 MEDIUM This Month POC

FreeScout is a free, self-hosted help desk and shared mailbox. Rated medium severity (CVSS 6.1), this vulnerability is r

CVE-2026-32754 CRITICAL Act Now

A stored cross-site scripting (XSS) vulnerability exists in FreeScout help desk software versions 1.8.208 and below, whe

CVE-2026-41193 CRITICAL Act Now

Arbitrary file write in FreeScout (prior to 1.8.215) allows authenticated administrators to achieve remote code executio

CVE-2026-41902 CRITICAL Act Now

Unauthenticated account takeover in FreeScout versions prior to 1.8.217 allows remote attackers to gain permanent access

CVE-2026-40498 HIGH This Week

Unauthenticated remote attackers can access administrative diagnostic endpoints in FreeScout versions prior to 1.8.213,

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2020-36847 CRITICAL POC

CVE-2017-6090 HIGH POC

Same technique File Upload

View all

CVE-2016-3088 CRITICAL POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2016-6600 CRITICAL POC

CVE-2017-6090 HIGH POC

CVE-2015-8249 CRITICAL POC

Share

CVE-2024-1932 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy