CVE-2007-2191: XSS

Published Apr 24, 2007

Updated

Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.

Affected Software

9 affected components

BSD BSD

HP HP-UX

HP Tru64

IBM AIX

Linux Linux kernel

Santa Cruz Operation Sco Unix

Sun Solaris

FreePBX FreePBX=2.2.1

FreePBX FreePBX=2.2_rc1

Event History

Apr 24, 2007

CVE Published

05:19 PM

Data Sourced

05:19 PM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2191?

CVE-2007-2191 is a medium severity vulnerability due to multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x.

How do I fix CVE-2007-2191?

To fix CVE-2007-2191, upgrade to a patched version of freePBX that addresses the XSS vulnerabilities.

What versions of freePBX are affected by CVE-2007-2191?

CVE-2007-2191 affects freePBX versions 2.2.x, specifically versions up to 2.2.1.

What are the potential impacts of CVE-2007-2191?

The potential impacts of CVE-2007-2191 include unauthorized script execution, which could lead to data theft or session hijacking.

Can CVE-2007-2191 be exploited remotely?

Yes, CVE-2007-2191 can be exploited remotely, allowing attackers to inject arbitrary web scripts via specific SIP protocol fields.