CVE-2024-28186

CVE-2024-28186 is a high-severity vulnerability in FreeScout, an open-source PHP help desk application, that exposes SMTP server credentials to authenticated users. The flaw stems from the application storing complete stack traces of exceptions in its database, which are then inadvertently disclosed via a specific endpoint. This allows an attacker to gain unauthorized access to SMTP usernames and passwords, potentially leading to unauthorized email sending and compromise of email communication integrity. The vulnerability has a CVSS score of 7.1 (High) due to its network attack vector, low attack complexity, and high impact on confidentiality and low impact on integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.