CVE-2021-37462

Name of the Vulnerable Software and Affected Versions NCH Axon PBX versions 2.22 and earlier

Description A Cross Site Scripting (XSS) issue exists, allowing for reflected XSS attacks via the /ipblacklist?errorip= endpoint. This can potentially lead to malicious script execution.

Recommendations For NCH Axon PBX versions 2.22 and earlier, as a temporary workaround, consider restricting access to the /ipblacklist?errorip= endpoint until a patch is available. Avoid using the errorip parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.