CVE-2025-71419
MediumCVSS 5.4Summary
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
Risk Assessment
Malicious script injected by an agent can execute in other users' browsers visiting the configuration page, potentially leading to session hijacking or unauthorized actions. The vulnerability requires the ROLE_AGENT role.
Recommendation
Upgrade UVdesk core-framework to version 1.1.7 or later. Until then, restrict access to the createMailerConfiguration action and audit existing mail configurations.
Other vulnerabilities in UVdesk core-framework
See all- CVE-2025-71421High
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
- CVE-2025-71420Medium
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
Original NVD description (English source)
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.