PT-2009-4266 · Sangoma · Freepbx

Publicado 2009-05-28 · Atualizado 2019-12-10 · CVE-2009-1801

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: FreePBX versions 2.4.x through 2.5.1 FreePBX pre-release versions 2.6.x

Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the display parameter to "reports.php", the order and extdisplay parameters to "config.php", and the sort parameter to "recordings/index.php".

Recommendations: For FreePBX versions 2.4.x through 2.5.1, consider restricting access to the affected parameters display, order, extdisplay, and sort in their respective files until a patch is available. For FreePBX pre-release versions 2.6.x, restrict access to the same parameters to minimize the risk of exploitation. As a temporary workaround, consider disabling the affected API endpoints "reports.php", "config.php", and "recordings/index.php" until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-1801

Produtos afetados

Freepbx

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/50361 · Nota
• http://secunia.com/advisories/34772 · Aviso do Fabricante
• http://securityfocus.com/bid/34857 · Correção
• http://osvdb.org/54261 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1801 · Nota de Segurança
• http://osvdb.org/54259 · Nota
• http://freepbx.org/trac/ticket/3660 · Nota
• http://osvdb.org/54260 · Nota