Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where…
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Oracle
- Product
- java
- CVSS
- 7.1
- Exposure class
- Database
Why it ranks 15 (Routine)
- CVSS 7.1 high
- Product class: database
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.