CVE-2020-28351

MEDIUM NUCLEI

Mitel Shoretel Firmware - XSS

Title source: rule

Description

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page.

Exploits (2)

exploitdb WORKING POC

by Joe Helle · textwebappsphp

https://www.exploit-db.com/exploits/49026

View Code ZIP pw:eip

nomisec WRITEUP 3 stars

by dievus · poc

https://github.com/dievus/CVE-2020-28351

View Code ZIP pw:eip

Nuclei Templates (1)

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

MEDIUMby pikpikcu

FOFA: body="ShoreTel" && icon_hash="268280373"

References (3)

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html

[Third Party Advisory] https://github.com/dievus/cve-2020-28351

[Vendor Advisory] https://www.mitel.com/articles/what-happened-shoretel-products

Scores

CVSS v3 6.1

EPSS 0.0931

EPSS Percentile 92.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

mitel/shoretel_firmware 19.46.1802.0

Published Nov 09, 2020

Tracked Since Feb 18, 2026