CVE-2023-37598
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
CVE-2023-37598 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete new virtual fax function.
Risk Assessment
An attacker can exploit this vulnerability to disrupt the system's operation, potentially leading to loss of availability of fax services within the organization.
Recommendation
It is recommended to upgrade to the latest version of issabel-pbx to mitigate this vulnerability and implement additional security measures against CSRF attacks.
Other vulnerabilities in issabel-pbx v.4.0.0-6
See all- CVE-2023-37599High
Version 4.0.0-6 of issabel-pbx contains a vulnerability that allows a remote attacker to obtain sensitive information via the modules directory.
- CVE-2023-37597High
CVE-2023-37597 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete user grouplist function.
- CVE-2023-37596High
CVE-2023-37596 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.
Original NVD description (English source)
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS