PT-2020-13200
CVE-2020-12679
·
تاريخ النشر
2020-05-07
·
تاريخ التحديث
2020-05-12
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Mitel ShoreTel Conference Web Application versions 19.50.1000.0 through versions prior to MiVoice Connect 18.7 SP2
Description
A reflected cross-site scripting (XSS) issue allows remote attackers to inject arbitrary JavaScript and HTML via the PATH INFO to "home.php". This enables attackers to execute malicious scripts on the client-side, potentially leading to unauthorized actions or data exposure.
Recommendations
For versions 19.50.1000.0 through versions prior to MiVoice Connect 18.7 SP2, update to MiVoice Connect 18.7 SP2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the "home.php" endpoint to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾