EUVD-2025-210746
GHSA-2vv3-69qg-3hgr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires low-privilege authentication; confidentiality impact is limited to file disclosure with no integrity, availability, or scope change.
Primary rating from Vendor (Kaspersky).
CVSS VectorVendor: Kaspersky
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
AnalysisAI
File enumeration in vsDesk service desk software allows remote authenticated attackers to predict and retrieve uploaded files by brute-forcing timestamp-derived filenames within a narrow time window. Affected instances running versions prior to 14.0101 expose any uploaded document to unauthorized access by any logged-in user, enabling secondary attacks through sensitive file exfiltration. No public exploit code has been identified at the time of analysis, and no CISA KEV listing exists.
Technical ContextAI
vsDesk is a Russian-language IT service desk platform (vsdesk.ru) whose file upload mechanism generates filenames using request timestamps - a pattern classified under CWE-340 (Generation of Predictable Numbers or Identifiers). Timestamps carry limited entropy and are bounded by the approximate time of the upload event, enabling an attacker to enumerate the search space through brute force within seconds to minutes. The affected CPE is cpe:2.3:a:vsdesk:vsdesk:*:*:*:*:*:*:*:*, covering all versions of the vsDesk application prior to the patch release. The root cause is in the file naming logic of the upload handler, which substitutes a cryptographically unpredictable identifier with a clock-derived value offering no meaningful randomness guarantee.
RemediationAI
Upgrade vsDesk to version 14.0101 or later, which is confirmed as the vendor-patched release per both the vendor site at https://vsdesk.ru/ and the Kaspersky advisory at https://github.com/klsecservices/Advisories/blob/master/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.md. If immediate patching is not feasible, implement server-side access controls on the file retrieval endpoint to enforce ownership or ticket-scoped authorization - ensuring that only the uploader or assigned ticket participants can retrieve a given file, rather than relying solely on filename obscurity. Additionally, restrict direct URL access to the file storage directory at the web server level (e.g., deny direct path traversal to the upload folder and route all file downloads through an authenticated controller). Enable access logging on file endpoints to detect sequential or time-based enumeration attempts. These compensating controls address the immediate exposure but do not fix the underlying weak naming logic, so patching remains the definitive remediation.
Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a r
Blind SQL injection in vsDesk (vsdesk.ru) exposes database contents and can render the application unresponsive via unau
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary oper
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today