Stored XSS Vulnerability in Zenitel Norway IP-StationWeb
CVE-2018-19927

4.8MEDIUM

Key Information:

Vendor

Zenitel

Status
Ip-stationweb Firmware
Vendor
CVE Published:
6 December 2018

What is CVE-2018-19927?

A stored cross-site scripting (XSS) vulnerability exists in Zenitel Norway's IP-StationWeb prior to version 4.2.3.9, allowing attackers to inject malicious scripts through the Display Name field in Station Status or Account Settings. This vulnerability is particularly concerning as it relates to the 'sip_nick' parameter in the goform/zForm_save_changes interface. In certain scenarios, the 'alphaadmin' password for the admin account could also be exploited for unauthorized access, increasing the risk of further attacks.

References

https://misteralfa-hack.blogspot.com/2018/12/zenitel-ip-s...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.