CVE-2020-21053 - Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\devices\device_imports.php

Back Back to CVE browser

MEDIUM

Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\devices\device_imports.php

Published May 20, 2021

6.1

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\devices\device_imports.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-13832
Advisory
https://github.com/fusionpbx/fusionpbx/commit/2ce613f1e9fe8ffab7a4cb9d1384444622285335
x_refsource_MISCPatchThird Party Advisory
https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-xss-22/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-13832		Advisory
https://github.com/fusionpbx/fusionpbx/commit/2ce613f1e9fe8ffab7a4cb9d1384444622285335		x_refsource_MISCPatchThird Party Advisory
https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-xss-22/		x_refsource_MISCThird Party Advisory