PT-2026-117401 · Frappe · Helpdesk
CVSS v3.1
4.6
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised by value. Attackers can call the hd ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get ticket activities.
Correção
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Helpdesk