CVE-2023-37596
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
CVE-2023-37596 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.
Risk Assessment
An attacker can exploit this vulnerability to disrupt system operations, potentially leading to service unavailability for users.
Recommendation
It is recommended to update to the latest version of issabel-pbx to mitigate this vulnerability and implement additional security measures against CSRF attacks.
Other vulnerabilities in issabel-pbx v.4.0.0-6
See all- CVE-2023-37599High
Version 4.0.0-6 of issabel-pbx contains a vulnerability that allows a remote attacker to obtain sensitive information via the modules directory.
- CVE-2023-37598Medium
CVE-2023-37598 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete new virtual fax function.
- CVE-2023-37597High
CVE-2023-37597 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete user grouplist function.
Original NVD description (English source)
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.