CVE-2025-48389

Katalog CVE

CVSS 7.2 · High EPSS 0,91%

Kerentanan Deserialization of Untrusted Data pada freescout. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the get method, deserialization will occur, which will allow arbitrary code execution This issue has been patched in version 1.8.178.

Rincian

Terbit di NVD

29 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jmpv-8q3h-2m8v exploit · advisory vendor
• https://github.com/freescout-help-desk/freescout/commit/f7548a7076a0b6e109001069d6be223fbd96c61e patch