Opensupports
Monthly
Vertical privilege escalation in OpenSupports 4.11.0 allows a Level 1 staff member to edit supervised user lists of any account, enabling unauthorized access to ticket content of other users. The vulnerability has publicly available proof-of-concept exploit code, but no active exploitation in the wild has been reported. EPSS probability is low at 0.04%.
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.
OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vertical privilege escalation in OpenSupports 4.11.0 allows a Level 1 staff member to edit supervised user lists of any account, enabling unauthorized access to ticket content of other users. The vulnerability has publicly available proof-of-concept exploit code, but no active exploitation in the wild has been reported. EPSS probability is low at 0.04%.
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.
OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.