FreeScout Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in FreeScout versions prior to 1.8.180. This issue arises from inadequate input validation and sanitization, allowing user input to be executed without proper filtering. An authorized user can inject arbitrary HTML or JavaScript into the application, potentially leading to the theft of sensitive data, hijacking of user sessions, or other malicious activities.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users are advised to update FreeScout to version 1.8.180 or later. For general guidance on preventing cross-site scripting vulnerabilities, refer to the OWASP Cross-Site Scripting Prevention Cheat Sheet.