Lucene search

VulDBCVE-2021-4282

HistoryDec 27, 2022 - 10:15 a.m.

CVE-2021-4282

2022-12-2710:15:11

CWE-79

VulDB

web.nvd.nist.gov

cve-2021-4282

freepbx

voicemail

remote code execution

cross site scripting

security vulnerability

patch

upgrade

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

54.3%

JSON

A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is 12e1469ef9208eda9d8955206e78345949236ee6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216871.

Affected configurations

Nvd

Node

sangomavoicemailRange<14.0.6.25freepbx

VendorProductVersionCPE
sangomavoicemail*cpe:2.3:a:sangoma:voicemail:*:*:*:*:*:freepbx:*:*

Vendor	Product	Version	CPE
sangoma	voicemail	*	cpe:2.3:a:sangoma:voicemail::::::freepbx::*

CNA Affected

[
  {
    "vendor": "FreePBX",
    "product": "voicemail",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

References

github.com/FreePBX/voicemail/commit/12e1469ef9208eda9d8955206e78345949236ee6

github.com/FreePBX/voicemail/releases/tag/release%2F14.0.6.25

vuldb.com/?ctiid.216871

vuldb.com/?id.216871

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

54.3%

JSON

Related for CVE-2021-4282