CVE-2021-37460

Name of the Vulnerable Software and Affected Versions NCH Axon PBX versions 2.22 and earlier

Description Cross Site Scripting (XSS) exists via the API endpoint "/planprop?id=" (reflected).

Recommendations For versions 2.22 and earlier, as a temporary workaround, consider restricting access to the "/planprop?id=" API endpoint until a patch is available. Avoid using the id parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.