Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:03
Type | Values Removed | Values Added |
---|---|---|
References | () http://freepbx.org/trac/ticket/3660 - | |
References | () http://osvdb.org/54259 - | |
References | () http://osvdb.org/54260 - | |
References | () http://osvdb.org/54261 - | |
References | () http://secunia.com/advisories/34772 - Vendor Advisory | |
References | () http://www.securityfocus.com/bid/34857 - Patch | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/50361 - |
Information
Published : 2009-05-28 14:30
Updated : 2024-11-21 01:03
NVD link : CVE-2009-1801
Mitre link : CVE-2009-1801
CVE.ORG link : CVE-2009-1801
JSON object : View
Products Affected
freepbx
- freepbx
sangoma
- freepbx
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')