PT-2009-6219 · Nch · Axon Virtual Pbx

Publicado 2009-11-20 · Atualizado 2009-11-23 · CVE-2009-4038

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NCH Software Axon Virtual PBX versions 2.10 through 2.11

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the onok or oncancel parameter to the logon program.

Recommendations For versions 2.10 and 2.11, avoid using the onok and oncancel parameters in the logon program until a fix is available. As a temporary workaround, consider restricting access to the logon program to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4038

Produtos afetados

Axon Virtual Pbx

Referências · 3

• http://osvdb.org/59871 · Nota
• http://secunia.com/advisories/37157 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4038 · Nota de Segurança