FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows…
Medium CVSS 5.4
Summary
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/freescout-help-desk/freescout/commit/889d75c8e3c15e6a7ddb6a4d4f65cc0379c29213 Patch
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211 Release Notes
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj Exploit
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-822g-7rw5-53xj Exploit
Timeline
- nvd_ingest NVD