CVE-2025-48388

Katalog CVE

CVSS 6.5 · Medium EPSS 0,38%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada freescout. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an attacker can pass a string containing special symbols (\r, \n, \t)to the application. This issue has been patched in version 1.8.178.

Rincian

Terbit di NVD

29 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-c76f-wggm-grcq advisory vendor
• https://github.com/freescout-help-desk/freescout/commit/eab97711027fff4bce90ccd2e189cbc184fa0370 patch