Summary
Unauthenticated external callers to FreePBX systems who can freely spoof/manipulate their Caller ID name/number are able to trigger browser attacks when FreePBX Administrators view the harmful data later on in the CEL reports page due to insufficient sanitization of potential XSS output.
Attackers must be able to set arbitrary Caller ID name/number.
Common Vulnerabilities and Exposures (CVE)
Requested
GitHub Security Advisory (GHSA)
GHSA-hq6g-xv43-3v87
Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red)
A - Amber
Link to Published GHSA with More Details
Highlights
