Cross Site Scripting Vulnerability in FusionPBX by FusionPBX
CVE-2020-21053

6.1MEDIUM

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
20 May 2021

What is CVE-2020-21053?

A Cross Site Scripting vulnerability exists in FusionPBX 4.5.7, which allows remote attackers to inject arbitrary web scripts or HTML into the application. This is accomplished via an unsanitized 'query_string' variable found in the device_imports.php file. Exploitation of this vulnerability can lead to unauthorized actions on behalf of users, compromising the integrity and security of the application.

References

https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-xs...
x_refsource_MISC
https://github.com/fusionpbx/fusionpbx/commit/2ce613f1e9f...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.