CVE-2015-2690: XSS

Published Aug 2, 2017

Updated

Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the (1) addlicensekey, (2) addlicensefirstname, (3) addlicenselastname, (4) addlicensecompany, (5) addlicenseaddress1, (6) addlicenseaddress2, (7) addlicensecity, (8) addlicensestate, (9) addlicensepostcode, (10) addlicensecountry, (11) addlicensephone, or (12) addlicenseemail parameter in an add-license-form page to admin/config.php.

Affected Software

1 affected component

Digium Addons Module Freepbx=2.11.0.6

Remediation

Patch Available

http://git.freepbx.org/projects/FREEPBX/repos/digiumaddoninstaller/commits/2aad006024b74c9ff53943d3e68527a3dffac855

Event History

Aug 2, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2690?

CVE-2015-2690 has a medium severity rating due to its potential to allow remote attackers to execute arbitrary scripts.

How do I fix CVE-2015-2690?

To fix CVE-2015-2690, users should upgrade the Digium Addons module to version 2.11.0.7 or later.

What is affected by CVE-2015-2690?

CVE-2015-2690 affects the Digium Addons module version 2.11.0.6 and earlier for FreePBX.

What type of vulnerability is CVE-2015-2690?

CVE-2015-2690 is classified as a cross-site scripting (XSS) vulnerability.

Can CVE-2015-2690 be exploited without authentication?

Yes, CVE-2015-2690 can potentially be exploited by unauthenticated remote attackers.