CVE-2020-12679

Name of the Vulnerable Software and Affected Versions Mitel ShoreTel Conference Web Application versions 19.50.1000.0 through versions prior to MiVoice Connect 18.7 SP2

Description A reflected cross-site scripting (XSS) issue allows remote attackers to inject arbitrary JavaScript and HTML via the PATH INFO to "home.php". This enables attackers to execute malicious scripts on the client-side, potentially leading to unauthorized actions or data exposure.

Recommendations For versions 19.50.1000.0 through versions prior to MiVoice Connect 18.7 SP2, update to MiVoice Connect 18.7 SP2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "home.php" endpoint to minimize the risk of exploitation.