CVE-2012-4870: XSS
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/indexamp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to panel/flash/mypage.php; (5) PATHINFO to admin/views/freepbxreload.php; or (6) login parameter to recordings/index.php.
Affected Software
Event History
Frequently Asked Questions
What are the vulnerabilities associated with CVE-2012-4870?
CVE-2012-4870 identifies multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier, allowing attackers to inject arbitrary web scripts or HTML.
What versions of FreePBX are affected by CVE-2012-4870?
FreePBX versions up to and including 2.9 are affected by CVE-2012-4870.
How can I fix CVE-2012-4870?
To mitigate CVE-2012-4870, you should upgrade FreePBX to the latest version that addresses the XSS vulnerabilities.
What potential impact does CVE-2012-4870 have?
The impact of CVE-2012-4870 includes the potential for attackers to execute malicious scripts in the context of a user's browser.
Is CVE-2012-4870 a critical vulnerability?
CVE-2012-4870 is considered to be of high severity due to its ability to facilitate XSS attacks on affected versions.