CVE-2012-4870 : Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier a

Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to panel/flash/mypage.php; (5) PATH_INFO to admin/views/freepbx_reload.php; or (6) login parameter to recordings/index.php.

Published 2012-09-06 17:55:02

Updated 2025-04-11 00:51:22

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2012-4870

Sangoma » Freepbx
Versions up to, including, (<=) 2.9
cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2012-4870

Top countries where our scanners detected CVE-2012-4870

Top open port discovered on systems with this issue 5060

IPs affected by CVE-2012-4870 127

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2012-4870!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2012-4870

EPSS FAQ

7.98%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-4870

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2012-4870

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-4870

http://secunia.com/advisories/48463

Sign in
Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2012/Mar/234

Full Disclosure: FreePBX remote command execution, xss
Exploit

CVEs referencing this url
http://packetstormsecurity.org/files/111028/FreePBX-2.10.0-Remote-Command-Execution-XSS.html

FreePBX 2.10.0 Remote Command Execution / XSS ≈ Packet Storm
Exploit

CVEs referencing this url
http://www.securityfocus.com/bid/52630

FreePBX Multiple Cross Site Scripting and Remote Command Execution Vulnerabilities
Exploit

CVEs referencing this url
http://www.exploit-db.com/exploits/18649

FreePBX 2.9.0/2.10.0 - Multiple Vulnerabilities - PHP webapps Exploit
Exploit

CVEs referencing this url
http://www.freepbx.org/trac/ticket/5711

System Dashboard - Sangoma Issue Tracker

CVEs referencing this url
http://secunia.com/advisories/48475

Sign in
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/74173

FreePBX multiple cross-site scripting CVE-2012-4870 Vulnerability Report