Trudesk
Monthly
Unauthenticated attackers can download private ticket attachments from Trudesk through 1.2.11 because express.static serves the public/ directory ahead of the hasAuth-guarded /uploads mount, so a direct request bypasses the authentication middleware entirely. Successful retrieval requires knowing or guessing a valid ticket MongoDB ObjectId plus the matching attachment filename, which is the main bound on the risk: no credentials or user interaction are needed and default configurations are affected, but the 12-byte ObjectId is not trivially guessable, so blind mass exploitation is impractical and realistic compromise depends on IDs and filenames leaking via URLs, email notifications, or referrers, or on an instance where IDs can be enumerated. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary file deletion and out-of-directory archive extraction in Trudesk through 1.2.11 let authenticated administrators turn backup-management endpoints into filesystem write and delete primitives. Exploitation requires an existing administrator account plus access to DELETE /api/v1/backup/:backup and POST /api/v1/backup/restore, where encoded traversal sequences and unvalidated file values bypass intended directory confinement. No public exploit identified at time of analysis, and no CISA KEV confirmation is present in the supplied data; the supplied CVSS:4.0 score is 7.0 and the independent CVSS:3.1 assessment is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
Unauthenticated remote attackers can wipe every group, tag and ticket in Trudesk 1.2.11 and earlier by calling the /debug/populatedb route, which remains registered whenever the NODE_ENV environment variable is unset - an unauthenticated, no-interaction, network-reachable action that destroys data integrity and availability (rated 8.3, CWE-1188) but is gated entirely by that deployment-configuration prerequisite rather than by any credential. The same call reseeds the database with default accounts whose password is 'password', so a successful wipe can additionally hand the attacker a working login to the emptied instance. No CISA KEV activity and no public exploit code were identified at time of analysis, and the overall signal is a credible but conditionally-gated destructive flaw rather than a top-tier emergency.
Authenticated NoSQL injection in Trudesk through 1.2.11 lets any low-privilege account manipulate the MongoDB $where clause in GET /api/v1/tickets/search, causing high-impact denial of service by looping mongod and exposing full ticket documents including internal notes. The flaw requires a valid account, so exploitation is not possible pre-auth, and no public exploit was identified at time of analysis. Risk is moderate and centered on malicious or compromised low-privilege users rather than anonymous internet attackers.
Path traversal in Trudesk through 1.2.11 allows any authenticated user to overwrite other accounts' avatar images by tampering with the _id and username fields of the profile image upload form. The flaw is an incomplete fix for CVE-2022-1752: a username such as /../../../x escapes the intended public/uploads/users directory, though writes are constrained to png, jpg, jpeg, and gif files and no confidentiality or availability impact is assessed (CVSS 5.3, PR:L, UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is a moderate, authentication-gated integrity problem rather than a top-tier priority.
Unauthenticated username enumeration in Trudesk through 1.2.11 allows remote attackers to submit crafted regular-expression patterns to POST /api/v1/login and infer valid accounts from distinguishable 'Invalid User' versus 'Invalid Password' responses. The issue is a regex/NoSQL injection in the login lookup (CWE-943) with low confidentiality impact; no public exploit identified at time of analysis and no CISA KEV confirmation. The CVSS 4.0 score is 6.9, and the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Stored cross-site scripting in Trudesk through 1.2.11 allows any authenticated user to upload script-bearing HTML or SVG files through the uploadlogo, uploadpagelogo, and uploadfavicon branding endpoints, which are then served unauthenticated from /assets/. Exploitation requires a valid low-privileged account (CVSS PR:L) and victim interaction when a page referencing the asset is loaded (UI:P); the impact is limited to integrity and cross-site scripting rather than remote code execution. No public exploit identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium).
Message spoofing and user impersonation in Trudesk through 1.2.11 allow authenticated users to inject messages as other accounts into conversations they do not belong to by supplying arbitrary owner and cId values to POST /api/v1/messages/send. The vulnerability is an incomplete fix for CVE-2022-1931, rated CVSS 5.3 with integrity-only impact and requiring a valid low-privilege session (PR:L); it is a moderate-severity integrity issue rather than a top-tier priority, and no public exploit identified at time of analysis.
Trudesk through 1.2.11 lets any authenticated low-privilege user forge the authorship of ticket activity by supplying an arbitrary ownerId or owner value in postComment, postInternalNote, and ticket-create requests, so comments and internal notes can appear to come from an administrator and tickets can be attributed to another user. The flaw is an integrity-only authorization bypass (CWE-639) with a moderate CVSS score of 5.3; default configurations are affected because ownership is taken from client input rather than the session. No public exploit code or CISA KEV entry was identified at time of analysis, and confidentiality and availability are not impacted.
Authorization bypass in Trudesk through 1.2.11 allows any authenticated user with the default tickets:update role grant to modify or mass-close tickets outside their assigned groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. The vendor CVSS 4.0 score is 5.3, and the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, reflecting integrity-only impact on ticket status, subject, group, priority, and assignee fields. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation.
Any authenticated Trudesk user can read tickets belonging to groups they are not a member of - subject, issue body, comments, ticket owner and assignee - by simply iterating sequential ticket IDs against GET /api/v1/tickets/:uid, and every release through 1.2.11 is affected. The apiTickets.single handler omits the group-membership check entirely, making this a textbook IDOR (CWE-639) instead of an injection or memory-safety bug, so attacker impact is limited to read-only disclosure with no modification or code execution. Risk is medium (CVSS 5.3; our assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): the only prerequisite is a valid account at any privilege level, no public exploit code or confirmed active exploitation has been identified at time of analysis, and instances that permit self-registration or host many low-privilege accounts should be treated as the highest exposure.
Authorization bypass in Trudesk through 1.2.11 lets any authenticated user read private conversations they do not belong to by supplying another conversation's ID to GET /api/v1/messages/conversation/:id, exposing full message history along with participants' usernames, full names and email addresses. Exploitation requires a valid low-privileged account (CVSS vector PR:L, confirmed by the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with risk rising sharply where self-service registration is enabled, and the attacker must know or enumerate valid conversation IDs. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation; the issue is a genuine but moderate-severity confidentiality problem rather than a critical priority, since impact is confined to read-only disclosure of message content and participant PII with no write or availability effect.
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unauthenticated attackers can download private ticket attachments from Trudesk through 1.2.11 because express.static serves the public/ directory ahead of the hasAuth-guarded /uploads mount, so a direct request bypasses the authentication middleware entirely. Successful retrieval requires knowing or guessing a valid ticket MongoDB ObjectId plus the matching attachment filename, which is the main bound on the risk: no credentials or user interaction are needed and default configurations are affected, but the 12-byte ObjectId is not trivially guessable, so blind mass exploitation is impractical and realistic compromise depends on IDs and filenames leaking via URLs, email notifications, or referrers, or on an instance where IDs can be enumerated. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary file deletion and out-of-directory archive extraction in Trudesk through 1.2.11 let authenticated administrators turn backup-management endpoints into filesystem write and delete primitives. Exploitation requires an existing administrator account plus access to DELETE /api/v1/backup/:backup and POST /api/v1/backup/restore, where encoded traversal sequences and unvalidated file values bypass intended directory confinement. No public exploit identified at time of analysis, and no CISA KEV confirmation is present in the supplied data; the supplied CVSS:4.0 score is 7.0 and the independent CVSS:3.1 assessment is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
Unauthenticated remote attackers can wipe every group, tag and ticket in Trudesk 1.2.11 and earlier by calling the /debug/populatedb route, which remains registered whenever the NODE_ENV environment variable is unset - an unauthenticated, no-interaction, network-reachable action that destroys data integrity and availability (rated 8.3, CWE-1188) but is gated entirely by that deployment-configuration prerequisite rather than by any credential. The same call reseeds the database with default accounts whose password is 'password', so a successful wipe can additionally hand the attacker a working login to the emptied instance. No CISA KEV activity and no public exploit code were identified at time of analysis, and the overall signal is a credible but conditionally-gated destructive flaw rather than a top-tier emergency.
Authenticated NoSQL injection in Trudesk through 1.2.11 lets any low-privilege account manipulate the MongoDB $where clause in GET /api/v1/tickets/search, causing high-impact denial of service by looping mongod and exposing full ticket documents including internal notes. The flaw requires a valid account, so exploitation is not possible pre-auth, and no public exploit was identified at time of analysis. Risk is moderate and centered on malicious or compromised low-privilege users rather than anonymous internet attackers.
Path traversal in Trudesk through 1.2.11 allows any authenticated user to overwrite other accounts' avatar images by tampering with the _id and username fields of the profile image upload form. The flaw is an incomplete fix for CVE-2022-1752: a username such as /../../../x escapes the intended public/uploads/users directory, though writes are constrained to png, jpg, jpeg, and gif files and no confidentiality or availability impact is assessed (CVSS 5.3, PR:L, UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is a moderate, authentication-gated integrity problem rather than a top-tier priority.
Unauthenticated username enumeration in Trudesk through 1.2.11 allows remote attackers to submit crafted regular-expression patterns to POST /api/v1/login and infer valid accounts from distinguishable 'Invalid User' versus 'Invalid Password' responses. The issue is a regex/NoSQL injection in the login lookup (CWE-943) with low confidentiality impact; no public exploit identified at time of analysis and no CISA KEV confirmation. The CVSS 4.0 score is 6.9, and the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Stored cross-site scripting in Trudesk through 1.2.11 allows any authenticated user to upload script-bearing HTML or SVG files through the uploadlogo, uploadpagelogo, and uploadfavicon branding endpoints, which are then served unauthenticated from /assets/. Exploitation requires a valid low-privileged account (CVSS PR:L) and victim interaction when a page referencing the asset is loaded (UI:P); the impact is limited to integrity and cross-site scripting rather than remote code execution. No public exploit identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium).
Message spoofing and user impersonation in Trudesk through 1.2.11 allow authenticated users to inject messages as other accounts into conversations they do not belong to by supplying arbitrary owner and cId values to POST /api/v1/messages/send. The vulnerability is an incomplete fix for CVE-2022-1931, rated CVSS 5.3 with integrity-only impact and requiring a valid low-privilege session (PR:L); it is a moderate-severity integrity issue rather than a top-tier priority, and no public exploit identified at time of analysis.
Trudesk through 1.2.11 lets any authenticated low-privilege user forge the authorship of ticket activity by supplying an arbitrary ownerId or owner value in postComment, postInternalNote, and ticket-create requests, so comments and internal notes can appear to come from an administrator and tickets can be attributed to another user. The flaw is an integrity-only authorization bypass (CWE-639) with a moderate CVSS score of 5.3; default configurations are affected because ownership is taken from client input rather than the session. No public exploit code or CISA KEV entry was identified at time of analysis, and confidentiality and availability are not impacted.
Authorization bypass in Trudesk through 1.2.11 allows any authenticated user with the default tickets:update role grant to modify or mass-close tickets outside their assigned groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. The vendor CVSS 4.0 score is 5.3, and the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, reflecting integrity-only impact on ticket status, subject, group, priority, and assignee fields. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation.
Any authenticated Trudesk user can read tickets belonging to groups they are not a member of - subject, issue body, comments, ticket owner and assignee - by simply iterating sequential ticket IDs against GET /api/v1/tickets/:uid, and every release through 1.2.11 is affected. The apiTickets.single handler omits the group-membership check entirely, making this a textbook IDOR (CWE-639) instead of an injection or memory-safety bug, so attacker impact is limited to read-only disclosure with no modification or code execution. Risk is medium (CVSS 5.3; our assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): the only prerequisite is a valid account at any privilege level, no public exploit code or confirmed active exploitation has been identified at time of analysis, and instances that permit self-registration or host many low-privilege accounts should be treated as the highest exposure.
Authorization bypass in Trudesk through 1.2.11 lets any authenticated user read private conversations they do not belong to by supplying another conversation's ID to GET /api/v1/messages/conversation/:id, exposing full message history along with participants' usernames, full names and email addresses. Exploitation requires a valid low-privileged account (CVSS vector PR:L, confirmed by the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with risk rising sharply where self-service registration is enabled, and the attacker must know or enumerate valid conversation IDs. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation; the issue is a genuine but moderate-severity confidentiality problem rather than a critical priority, since impact is confined to read-only disclosure of message content and participant PII with no write or availability effect.
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.