Cross Site Scripting Vulnerability in FusionPBX by FusionPBX
CVE-2021-37524

6.1MEDIUM

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
1 July 2022

What is CVE-2021-37524?

A Cross Site Scripting (XSS) vulnerability exists in FusionPBX 4.5.26 that enables remote, unauthenticated users to execute arbitrary web scripts or HTML. This vulnerability is exploited through an unsanitized 'path' parameter in the resources/login.php file, posing significant risks to the integrity of the application and its users.

References

https://www.fusionpbx.com/app/tickets/ticket_edit.php?id=...
x_refsource_MISC
https://github.com/fusionpbx/fusionpbx/commit/c3b811393de...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.