CVE-2023-37597
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
CVE-2023-37597 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete user grouplist function.
Risk Assessment
An attacker can exploit this vulnerability to disrupt system operations, potentially leading to service downtime and loss of access to critical functions.
Recommendation
It is recommended to update to the latest version of issabel-pbx and implement protections against CSRF attacks.
Other vulnerabilities in issabel-pbx v.4.0.0-6
See all- CVE-2023-37599High
Version 4.0.0-6 of issabel-pbx contains a vulnerability that allows a remote attacker to obtain sensitive information via the modules directory.
- CVE-2023-37598Medium
CVE-2023-37598 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete new virtual fax function.
- CVE-2023-37596High
CVE-2023-37596 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.
Original NVD description (English source)
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function.