CVE-2025-48483: FreeScout Stored XSS leads to CSRF
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitization. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Additionally, if an administrator accesses one of these emails with a modified signature, it could result in a subsequent Cross-Site Request Forgery (CSRF) vulnerability. This issue has been patched in version 1.8.180.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48483?
CVE-2025-48483 is classified as a medium severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-48483?
To fix CVE-2025-48483, upgrade FreeScout to version 1.8.180 or later, which addresses the XSS vulnerability.
What types of applications are affected by CVE-2025-48483?
CVE-2025-48483 affects the FreeScout application versions prior to 1.8.180.
What can attackers do by exploiting CVE-2025-48483?
Attackers can exploit CVE-2025-48483 to execute malicious scripts in the context of a user's session, potentially stealing sensitive information.
What causes the vulnerability in CVE-2025-48483?
CVE-2025-48483 is caused by incorrect input validation and sanitization of user-input data during mail signature sanitization.