PT-2024-22540 · Innovaphone · Innovaphone Pbx

Published 2024-04-22 · Updated 2024-07-03 · CVE-2024-28722

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Innovaphone myPBX versions 12r2 through 14r1

Description The issue allows a remote attacker to execute arbitrary code via the query parameter to the "/CMD0/xml modes.xml" endpoint. This enables the attacker to perform actions such as injecting malicious scripts.

Recommendations For versions 12r2 through 14r1, as a temporary workaround, consider restricting access to the "/CMD0/xml modes.xml" endpoint until a patch is available. Avoid using the query parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-28722

Affected Products

Innovaphone Pbx

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-28722 · Security Note
• http://innovaphone.com · Note
• http://mypbx.com · Note
• https://t.me/cvenotify/77586 · Telegram Post
• https://wiki.innovaphone.com/index.php?title=Reference14r1:Release_Notes_Firmware#159317_-_Advanced_UI:_Prevent_XSL_injection · Note