CVE-2009-1801: XSS

Published May 28, 2009

Updated

Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information.

Affected Software

12 affected components

FreePBX FreePBX=2.5.0rc2

FreePBX FreePBX=2.4.0_beta1

FreePBX FreePBX=2.5.2

FreePBX FreePBX=2.5.0_beta1

FreePBX FreePBX=2.4.1

FreePBX FreePBX=2.4.0_beta2

FreePBX FreePBX=2.5.0rc3

FreePBX FreePBX=2.5.1

FreePBX FreePBX=2.4

Sangoma FreePBX =2.4.0

Sangoma FreePBX =2.5.0

FreePBX=2.5.0

Remediation

Patch Available

http://www.securityfocus.com/bid/34857

Event History

May 28, 2009

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1801?

CVE-2009-1801 has a medium severity level due to its potential for cross-site scripting attacks.

How do I fix CVE-2009-1801?

To fix CVE-2009-1801, you should upgrade FreePBX to a version that has addressed these XSS vulnerabilities.

Which versions of FreePBX are affected by CVE-2009-1801?

CVE-2009-1801 affects FreePBX versions 2.4.x, 2.5.x, and pre-release 2.6.x, including version 2.5.1.

What types of attacks are possible with CVE-2009-1801?

CVE-2009-1801 allows remote attackers to inject arbitrary web scripts or HTML, leading to potential data theft or session hijacking.

What component of FreePBX is vulnerable in CVE-2009-1801?

CVE-2009-1801 targets the reports.php and config.php components of FreePBX.