PT-2024-12439 · Splicecom · Splicecom Maximiser Soft Pbx

Published 2024-01-25 · Updated 2024-01-31 · CVE-2023-33758

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Splicecom Maximiser Soft PBX versions 1.5 and earlier

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited via the CLIENT NAME and DEVICE GUID fields in the login component.

Recommendations For Splicecom Maximiser Soft PBX versions 1.5 and earlier, consider disabling the login component until a patch is available. Restrict access to the CLIENT NAME and DEVICE GUID fields to minimize the risk of exploitation. Avoid using these fields in the login component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-33758

Affected Products

Splicecom Maximiser Soft Pbx

References · 6

• 🔥 https://github.com/twignet/splicecom · Exploit
• https://osv.dev/vulnerability/CVE-2023-33758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33758 · Security Note
• https://t.me/cvenotify/69419 · Telegram Post
• https://twitter.com/CVEnew/status/1750426416137535766 · Twitter Post
• https://t.me/cvenotify/68634 · Telegram Post