Medium severity · published Jun 24, 2024
CVE-2021-45785
TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Trudesk · Trudesk Project
1.1.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45785
Exploit
https://1d8.github.io/cves/cve_2021_45785/
More from Trudesk
9.8
CVE-2022-2128
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4
9.8
CVE-2022-2023
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4
9.8
CVE-2022-1775
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2
8.8
CVE-2022-1808
Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3
8.8
CVE-2022-1770
Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2