CVE-2024-3137: UVDesk Community Helpdesk Improper Privilege Management
Summary
CVE-2024-3137: UVDesk Community Helpdesk Improper Privilege Management. Affects uvdesk/core-framework versions < 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UVDesk Community Helpdesk is a popular open-source helpdesk system that provides a platform for managing customer support tickets. It is built on the uvdesk/core-framework package, which is available on Packagist. The uvdesk/core-framework package is a fundamental component of the UVDesk Community Helpdesk system, providing core functionalities and features.
Vulnerability Detail
The UVDesk Community Helpdesk system is affected by an improper privilege management vulnerability. This vulnerability allows an authenticated low-privileged user to escalate their privileges and gain unauthorized access to sensitive information or perform actions reserved for higher-privileged users. The vulnerability originates from a flaw in the privilege management implementation within the uvdesk/core-framework package. An attacker exploiting this vulnerability could potentially compromise the confidentiality and integrity of the UVDesk Community Helpdesk system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the uvdesk/core-framework package to the latest version to mitigate the risk of exploitation.
Conclusion
The UVDesk Community Helpdesk system is affected by an improper privilege management vulnerability. To ensure the security of the system, it is crucial to update the uvdesk/core-framework package to version 1.1.2 or later. This update will patch the vulnerability and prevent potential unauthorized access or information disclosure. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for uvdesk/core-framework →
FAQ
This vulnerability allows an authenticated low-privileged user to escalate their privileges and potentially gain unauthorized access to sensitive information or perform actions reserved for higher-privileged users.
Yes, an attacker must have a valid authenticated account with low privileges to exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
No, this vulnerability requires an authenticated user to exploit it. Remote exploitation is not possible.
Yes, the UVDesk development team has addressed this vulnerability in the latest release of the uvdesk/core-framework package (version 1.1.2). It is recommended to update to the latest version to mitigate the risk.
