PT-2021-3696 · Unknown · Issabel-Pbx

Published 2021-01-09 · Updated 2021-07-08 · CVE-2021-34190

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Issabel PBX version 4

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by a remote attacker to execute arbitrary web scripts or HTML. The exploitation occurs through a crafted payload entered into the Name or Prefix fields under the "Create New Rate" module in the index.php?menu=billing rates endpoint.

Recommendations For Issabel PBX version 4, update to a version that includes a fix for this issue, as the current version allows attackers to execute arbitrary web scripts or HTML via crafted payloads in specific fields. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-03929

CVE-2021-34190

Affected Products

Issabel-Pbx

References · 6

• 🔥 https://research.0xdutra.com/posts/research-issabel-stored-xss · Exploit
• 🔥 https://youtube.com/watch?v=apJH_D68lZI · Exploit
• https://bdu.fstec.ru/vul/2021-03929 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34190 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34190 · Vendor Advisory
• https://t.me/cibsecurity/25941 · Telegram Post