PT-2021-10576 · Fusionpbx · Fusionpbx

Pierre Jourdan · Published 2021-05-20 · Updated 2021-05-25 · CVE-2020-21053

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FusionPBX version 4.5.7

Description: A Cross Site Scripting (XSS) issue exists, allowing remote malicious users to inject arbitrary web script or HTML via an unsanitized query string variable in the appdevicesdevice imports.php file.

Recommendations: For FusionPBX version 4.5.7, update the software to a version that sanitizes the query string variable, or as a temporary workaround, consider restricting access to the device imports.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-21053

Affected Products

Fusionpbx

References · 5

• https://github.com/fusionpbx/fusionpbx/commit/2ce613f1e9fe8ffab7a4cb9d1384444622285335 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-21053 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21053 · Vendor Advisory
• https://t.me/cvenotify/15033 · Telegram Post
• https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-xss-22 · Note