Cross-Site Scripting Vulnerability in FusionPBX by FusionPBX
CVE-2024-23387

4.8MEDIUM

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
19 January 2024

What is CVE-2024-23387?

FusionPBX prior to version 5.1.0 is susceptible to a cross-site scripting vulnerability. This issue allows a remote authenticated attacker with administrative privileges to inject and execute arbitrary scripts in the context of a user's web browser during login. This could potentially lead to unauthorized actions, including data theft or manipulation, significantly compromising user security.

Affected Version(s)

FusionPBX prior to 5.1.0

References

https://www.fusionpbx.com/
https://github.com/fusionpbx/fusionpbx/
https://jvn.jp/en/jp/JVN67215338/

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.