CVE-2020-12679: XSS
Published May 7, 2020
·Updated
A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATHINFO to home.php.
Affected Software
2 affected components
Mitel MiVoice Connect<21.90.9743.0
Mitel ShoreTel Conference Web=19.50.1000.0
Event History
May 7, 2020
CVE Published
via MITRE·04:36 PM
Data Sourced
via MITRE·04:36 PM
Description
Frequently Asked Questions
1
What is CVE-2020-12679?
CVE-2020-12679 is a reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application.
2
What is the severity of CVE-2020-12679?
The severity of CVE-2020-12679 is medium with a CVSS score of 6.1.
3
How does CVE-2020-12679 impact Mitel MiVoice Connect?
CVE-2020-12679 impacts Mitel MiVoice Connect versions up to 21.90.9743.0.
4
How does CVE-2020-12679 impact Mitel ShoreTel Conference Web?
CVE-2020-12679 impacts Mitel ShoreTel Conference Web version 19.50.1000.0.
5
How can I fix CVE-2020-12679?
Update Mitel ShoreTel Conference Web Application and Mitel MiVoice Connect to the latest secure versions.