CVE-2023-42228

CVE-2023-42228 is an Incorrect Access Control vulnerability (CWE-281) affecting Pat Infinite Solutions HelpdeskAdvanced versions up to and including 11.0.33. Low-privileged users can edit their own Access Control List (ACL) rules by sending a request directly to the administrative function "AclList/SaveAclRules," bypassing intended restrictions on such operations.

The vulnerability can be exploited by low-privileged users (PR:L) over the network (AV:N) with low attack complexity (AC:L), requiring no user interaction (UI:N) and maintaining unchanged scope (S:U). Successful exploitation results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 8.8. This allows attackers to modify ACL rules for their accounts, potentially enabling unauthorized access escalations or other privilege abuses within the HelpdeskAdvanced system.

The primary reference is a GitLab repository at https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md documenting the CVE, with no specific mitigation or patch details provided in the available information. The CVE was published on 2025-01-13.