CVE-2023-0325: Uvdesk vulnerable to stored cross-site scripting (XSS)

April 5, 2023 (updated February 13, 2025)

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.

References

fluidattacks.com/advisories/labrinth
github.com/advisories/GHSA-fwhv-9phj-wrj5
github.com/uvdesk/community-skeleton
nvd.nist.gov/vuln/detail/CVE-2023-0325

Code Behaviors & Features

Detect and mitigate CVE-2023-0325 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →