CVE-2009-1801

NONE EPSS 66.1%

Published May 28, 200917y ago · Modified Jun 16, 20262w ago

Published May 28, 2009 17y ago

Last Modified Jun 16, 2026 2w ago

Description

Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information.

Threat Intelligence

EPSS Exploit Probability

66.1% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 11

Vendor	Product	Version	Range
freepbx	freepbx	2.4	any
freepbx	freepbx	2.4.0_beta1	any
freepbx	freepbx	2.4.0_beta2	any
freepbx	freepbx	2.4.1	any
freepbx	freepbx	2.5.0_beta1	any
freepbx	freepbx	2.5.0rc2	any
freepbx	freepbx	2.5.0rc3	any
freepbx	freepbx	2.5.1	any
freepbx	freepbx	2.5.2	any
sangoma	freepbx	2.4.0	any
sangoma	freepbx	2.5.0	any

References 7

freepbx.org http://freepbx.org/trac/ticket/3660
osvdb.org http://osvdb.org/54259
osvdb.org http://osvdb.org/54260
osvdb.org http://osvdb.org/54261
secunia.com http://secunia.com/advisories/34772

Vendor Advisory
securityfocus.com http://www.securityfocus.com/bid/34857

Patch
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/50361

Remediation

securityfocus.com http://www.securityfocus.com/bid/34857

Patch