CVE-2021-37459: XSS
Published Jul 25, 2021
·Updated
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
Affected Software
1 affected component
Nchsoftware Axon Pbx<=2.22
Event History
Jul 25, 2021
CVE Published
via MITRE·08:10 PM
Data Sourced
via MITRE·08:10 PM
Description
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-37459?
The severity of CVE-2021-37459 is medium, with a CVSS score of 5.4.
2
How does the Cross-Site Scripting (XSS) vulnerability in NCH Axon PBX v2.22 and earlier occur?
The Cross-Site Scripting (XSS) vulnerability in NCH Axon PBX v2.22 and earlier occurs through the customer name field, allowing the injection of malicious scripts.
3
Which version of NCH Axon PBX is affected by CVE-2021-37459?
NCH Axon PBX v2.22 and earlier versions are affected by CVE-2021-37459.
4
How can I fix the Cross-Site Scripting (XSS) vulnerability in NCH Axon PBX?
To fix the Cross-Site Scripting (XSS) vulnerability in NCH Axon PBX, it is recommended to update to a version later than v2.22.
5
Where can I find more information about CVE-2021-37459?
More information about CVE-2021-37459 can be found at the following references: [GitHub](https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md) and [NCH Axon PBX](https://www.nch.com.au/pbx/index.html).