FreePBX Multiple Cross Site Scripting and Information Disclosure Vulnerabilities
BID:34857
Info
FreePBX Multiple Cross Site Scripting and Information Disclosure Vulnerabilities
| Bugtraq ID: | 34857 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 07 2009 12:00AM |
| Updated: | May 08 2009 12:56AM |
| Credit: | Mike Bailey and Dejan Levaja |
| Vulnerable: |
freePBX freePBX 2.5.2 freePBX freePBX 2.5.1 freePBX freePBX 2.4.1 freePBX freePBX trunk freePBX freePBX 2.5 freePBX freePBX 2.4 |
| Not Vulnerable: | |
Discussion
FreePBX Multiple Cross Site Scripting and Information Disclosure Vulnerabilities
FreePBX is prone to multiple cross-site scripting and information-disclosure vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may also exploit these issues to obtain sensitive information.
FreePBX 2.4, 2.5, and trunk are affected.
FreePBX is prone to multiple cross-site scripting and information-disclosure vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may also exploit these issues to obtain sensitive information.
FreePBX 2.4, 2.5, and trunk are affected.
Exploit / POC
FreePBX Multiple Cross Site Scripting and Information Disclosure Vulnerabilities
Attackers may exploit these issues via a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting victim into following a malicious URI.
Attackers may exploit these issues via a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
FreePBX Multiple Cross Site Scripting and Information Disclosure Vulnerabilities
Solution:
Updates are available. Please see the references for details.
freePBX freePBX trunk
freePBX freePBX 2.4.1
freePBX freePBX 2.5.1
freePBX freePBX 2.5.2
Solution:
Updates are available. Please see the references for details.
freePBX freePBX trunk
-
freePBX Module Publish Script: framework 2.6.0.alpha1.0
http://freepbx.org/trac/changeset/7660 -
freePBX Module Publish Script: fw_ari 2.6.0.0
http://freepbx.org/trac/changeset/7661
freePBX freePBX 2.4.1
-
freePBX Module Publish Script: framework 2.4.1.3
http://freepbx.org/trac/changeset/7659
freePBX freePBX 2.5.1
-
freePBX Module Publish Script: framework 2.5.1.3
http://freepbx.org/trac/changeset/7650
freePBX freePBX 2.5.2
-
freePBX Module Publish Script: fw_ari 2.5.2.3
http://freepbx.org/trac/changeset/7651
References
FreePBX Multiple Cross Site Scripting and Information Disclosure Vulnerabilities
References:
References:
- FreePBX Homepage (FreePBX)
- CSS and CSRF Security Vulnerabilities and User Account Enumeration (FreePBX)