PT-2009-6219 · Nch · Axon Virtual Pbx

Published 2009-11-20 · Updated 2009-11-23 · CVE-2009-4038

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NCH Software Axon Virtual PBX versions 2.10 through 2.11

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the onok or oncancel parameter to the logon program.

Recommendations For versions 2.10 and 2.11, avoid using the onok and oncancel parameters in the logon program until a fix is available. As a temporary workaround, consider restricting access to the logon program to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4038

Affected Products

Axon Virtual Pbx

References · 3

• http://secunia.com/advisories/37157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4038 · Security Note
• http://osvdb.org/59871 · Note