CVE-2009-1801: XSS
First published: Thu May 28 2009(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FreePBX | =2.5.0rc2 | |
| FreePBX | =2.4.0_beta1 | |
| FreePBX | =2.5.2 | |
| FreePBX | =2.5.0_beta1 | |
| FreePBX | =2.4.1 | |
| FreePBX | =2.4.0_beta2 | |
| FreePBX | =2.5.0rc3 | |
| FreePBX | =2.5.1 | |
| FreePBX | =2.4 | |
| FreePBX | =2.4.0 | |
| FreePBX | =2.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-1801?
CVE-2009-1801 has a medium severity level due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-1801?
To fix CVE-2009-1801, you should upgrade FreePBX to a version that has addressed these XSS vulnerabilities.
Which versions of FreePBX are affected by CVE-2009-1801?
CVE-2009-1801 affects FreePBX versions 2.4.x, 2.5.x, and pre-release 2.6.x, including version 2.5.1.
What types of attacks are possible with CVE-2009-1801?
CVE-2009-1801 allows remote attackers to inject arbitrary web scripts or HTML, leading to potential data theft or session hijacking.
What component of FreePBX is vulnerable in CVE-2009-1801?
CVE-2009-1801 targets the reports.php and config.php components of FreePBX.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/freepbx
- canonical/freepbx
- version/freepbx/2.5.0rc2
- version/freepbx/2.4.0_beta1
- version/freepbx/2.5.2
- version/freepbx/2.5.0_beta1
- version/freepbx/2.4.1
- version/freepbx/2.4.0_beta2
- version/freepbx/2.5.0rc3
- version/freepbx/2.5.1
- version/freepbx/2.4
- vendor/sangoma
- version/freepbx/2.4.0
- version/freepbx/2.5.0