PT-2017-14590 · Vonage · Vonage Vdv-23 115

Nu11By73 · Published 2017-11-16 · Updated 2017-12-02 · CVE-2017-16843

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vonage VDV-23 115 versions 3.2.11-0.9.40

Description The issue concerns stored XSS that can be triggered via the NewKeyword or NewDomain field to the "/goform/RgParentalBasic" API endpoint.

Recommendations For Vonage VDV-23 115 versions 3.2.11-0.9.40, as a temporary workaround, consider restricting access to the "/goform/RgParentalBasic" API endpoint until a patch is available. Avoid using the NewKeyword or NewDomain fields in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16843

Affected Products

Vonage Vdv-23 115

References · 4

• 🔥 https://exploit-db.com/exploits/43150 · Exploit
• https://osv.dev/vulnerability/CVE-2017-16843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16843 · Security Note
• https://gh0s7.net/vonage · Note