CVE-2023-37189
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A stored cross site scripting (XSS) vulnerability in Issabel PBX version 4 in index.php?menu=billing_rates allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.
Risk Assessment
This vulnerability may lead to session hijacking, data theft, or the introduction of malware, posing a significant security threat to the organization.
Recommendation
It is recommended to update Issabel PBX to the latest version to mitigate this vulnerability and to implement input validation in form fields.
Original NVD description (English source)
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.