CVE-2009-4458: XSS
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4458?
The severity of CVE-2009-4458 is high due to its potential for remote code execution via cross-site scripting (XSS).
How do I fix CVE-2009-4458?
To fix CVE-2009-4458, upgrade FreePBX to the latest version that addresses these vulnerabilities.
Which versions of FreePBX are affected by CVE-2009-4458?
CVE-2009-4458 affects FreePBX versions 2.5.2 and 2.6.0-rc2, as well as possibly other versions.
What type of attack does CVE-2009-4458 enable?
CVE-2009-4458 enables remote attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary scripts.
Can I mitigate CVE-2009-4458 without an upgrade?
Mitigating CVE-2009-4458 without an upgrade is challenging; it's recommended to sanitize input and implement web application firewalls.