CVE-2023-52268 - The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint

Back Back to CVE browser

CRITICAL

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint

Published Nov 12, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 0.62%

Description

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub.

Affected products

Vendor Freescout Helpdesk Product Freescout Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <1.0.65

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Freescout Helpdesk

Freescout

n/a

Version	Status	Constraints
0	affected	<1.0.65

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-384

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-56941		Advisory
https://freescout.net/module/end-user-portal/
https://freescout.net/modules-faq/
https://github.com/squ1dw3rm/CVE-2023-52268