Libredesk
Monthly
Stored cross-site scripting in LibreDesk versions before 2.9.0-rc.8 allows an authenticated agent to upload a crafted SVG whose Content-Type is supplied with a trailing parameter (for example 'image/svg+xml; x'), causing the application's exact-match check against 'image/svg+xml' to fail so the file is served inline without a sandboxing Content-Security-Policy instead of as an attachment. When a victim agent or administrator subsequently requests GET /uploads/{uuid}, the embedded script executes in their browser session, giving the attacker the ability to act with the victim's privileges in the helpdesk UI. Exploitation requires a valid agent session (CVSS vector PR:L) and victim interaction (UI:P), and only pre-2.9.0-rc.8 instances are affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), so it ranks as a medium-priority, patched vulnerability.
Stored HTML injection in the LibreDesk customer support desk allows an authenticated user who can add contact notes to persist arbitrary HTML - including forms, inputs, and images - that renders in the application when another user later views the affected contact. Affected are all self-hosted LibreDesk deployments prior to 0.8.6-beta; exploitation requires an authenticated account with note-creation permission, the ability to intercept the POST /api/v1/contacts/{id}/notes request and strip the client-added <p> wrapper (the backend trusts client-supplied markup and performs no server-side sanitization), and a second user - impact rises if that user is privileged - to open the notes for the payload to render. The advisory establishes phishing, HTML-only CSRF-style forced actions, and UI-redress impact; arbitrary JavaScript execution is not established, publicly available exploit code exists, and the issue is rated a moderate priority in independent assessment. The vendor has patched in version 0.8.6-beta.
Stored cross-site scripting in LibreDesk versions before 2.9.0-rc.8 allows an authenticated agent to upload a crafted SVG whose Content-Type is supplied with a trailing parameter (for example 'image/svg+xml; x'), causing the application's exact-match check against 'image/svg+xml' to fail so the file is served inline without a sandboxing Content-Security-Policy instead of as an attachment. When a victim agent or administrator subsequently requests GET /uploads/{uuid}, the embedded script executes in their browser session, giving the attacker the ability to act with the victim's privileges in the helpdesk UI. Exploitation requires a valid agent session (CVSS vector PR:L) and victim interaction (UI:P), and only pre-2.9.0-rc.8 instances are affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), so it ranks as a medium-priority, patched vulnerability.
Stored HTML injection in the LibreDesk customer support desk allows an authenticated user who can add contact notes to persist arbitrary HTML - including forms, inputs, and images - that renders in the application when another user later views the affected contact. Affected are all self-hosted LibreDesk deployments prior to 0.8.6-beta; exploitation requires an authenticated account with note-creation permission, the ability to intercept the POST /api/v1/contacts/{id}/notes request and strip the client-added <p> wrapper (the backend trusts client-supplied markup and performs no server-side sanitization), and a second user - impact rises if that user is privileged - to open the notes for the payload to render. The advisory establishes phishing, HTML-only CSRF-style forced actions, and UI-redress impact; arbitrary JavaScript execution is not established, publicly available exploit code exists, and the issue is rated a moderate priority in independent assessment. The vendor has patched in version 0.8.6-beta.