PT-2021-10577 · Fusionpbx · Fusionpbx

Pierre Jourdan · Published 2021-05-20 · Updated 2021-05-25 · CVE-2020-21054

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FusionPBX version 4.5.7

Description: A Cross Site Scripting (XSS) issue allows remote malicious users to inject arbitrary web script or HTML via an unsanitized f variable in the appvarsvars textarea.php file. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations: For FusionPBX version 4.5.7, as a temporary workaround, consider sanitizing the f variable in the appvarsvars textarea.php file to prevent XSS attacks. Restrict access to the vars textarea.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-21054

Affected Products

Fusionpbx

References · 5

• https://github.com/fusionpbx/fusionpbx/commit/2489004c7b7e0b14e21cd86cedaab87fed209415 · Patch
• https://osv.dev/vulnerability/CVE-2020-21054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21054 · Security Note
• https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-xss-21 · Note
• https://t.me/cvenotify/15031 · Telegram Post