CVE-2007-2191

NONE EPSS 90.2%

Published Apr 24, 200719y ago · Modified Jun 16, 20262w ago

Published Apr 24, 2007 19y ago

Last Modified Jun 16, 2026 2w ago

Description

Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.

Threat Intelligence

EPSS Exploit Probability

90.2% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Affected Products 9

Vendor	Product	Version	Range
bsd	bsd	*	any
hp	hp-ux	*	any
hp	tru64	*	any
ibm	aix	*	any
linux	linux_kernel	*	any
santa_cruz_operation	sco_unix	*	any
sun	solaris	*	any
freepbx	freepbx	2.2.1	any
freepbx	freepbx	2.2_rc1	any

References 7

lists.grok.org.uk http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053882.html

Exploit
osvdb.org http://osvdb.org/35315
secunia.com http://secunia.com/advisories/24935
securityreason.com http://securityreason.com/securityalert/2627
securityfocus.com http://www.securityfocus.com/bid/23575
vupen.com http://www.vupen.com/english/advisories/2007/1535
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/33772

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.