Vulnerability · Published Apr 4, 2023 · Assigned by Fluid Attacks
CVE-2023-0265
High 8.8
In plain English
A high-severity unrestricted file upload in Uvdesk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.6%top 24.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | uvdesk/community-skeleton | no fix listed | GHSA-2hw6-4rv9-82fp |
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H