CVE-2023-1125 — Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add …
Published: 2023-05-02 · CVSS: 6.5 · CVSS 3.1
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7