medium6.1
CVE-2021-37524
Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "pat…
Impact
Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fusionpbx | Fusionpbx | before 5.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/fusionpbx/fusionpbx/commit/c3b811393de63e324eaa64fe5c9ea3fce428fe1a
- https://www.fusionpbx.com/app/tickets/ticket_edit.php?id=4a0666cd-8c12-46ae-bc0a-02f007b62cdb
- https://github.com/fusionpbx/fusionpbx/commit/c3b811393de63e324eaa64fe5c9ea3fce428fe1a
- https://www.fusionpbx.com/app/tickets/ticket_edit.php?id=4a0666cd-8c12-46ae-bc0a-02f007b62cdb