Vulnerabilidades do Uvdesk Core-framework

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Uvdesk Core-framework: 3 registro(s), com versões afetadas e correções.

CVE-2025-71421 Alta · 7.2 CWE-269 21/09/2026

UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.

CVE-2025-71420 Média · 4.3 CWE-639 21/09/2026

UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

CVE-2025-71419 Média · 5.4 CWE-79 21/09/2026

UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.