CVE-2020-21054: XSS

Published May 20, 2021

Updated

Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\vars\varstextarea.php.

Affected Software

1 affected component

FusionPBX Fusionpbx=4.5.7

Remediation

Patch Available

https://github.com/fusionpbx/fusionpbx/commit/2489004c7b7e0b14e21cd86cedaab87fed209415

Event History

May 20, 2021

CVE Published

via MITRE·03:31 PM

Data Sourced

via MITRE·03:31 PM

Description

Frequently Asked Questions

What is CVE-2020-21054?

CVE-2020-21054 is a Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7.

How does CVE-2020-21054 affect FusionPBX?

CVE-2020-21054 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\vars\vars_textarea.php.

What is the severity of CVE-2020-21054?

The severity of CVE-2020-21054 is medium with a CVSS score of 6.1.

How can I fix CVE-2020-21054?

To fix CVE-2020-21054, update FusionPBX to version 4.5.8 or later.

Where can I find more information about CVE-2020-21054?

You can find more information about CVE-2020-21054 in the references: [GitHub Commit](https://github.com/fusionpbx/fusionpbx/commit/2489004c7b7e0b14e21cd86cedaab87fed209415) and [Resp3ctBlog](https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-xss-21/).