CVE-2020-28351

MEDIUMNuclei

ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-28351 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit, 1 repository PoC, and 1 Nuclei template.

Description

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1
Nuclei templates
1

Proofs of concept

2

Catalogued exploits

ExploitDBShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site ScriptingExploitDB exploitby Joe HelleNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubdievus/CVE-2020-28351Repository PoCby dievus3Not analyzed4 files

58.1 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMMitel ShoreTel 19.46.1802.0 Devices - Cross-Site ScriptingCVSS 6.1

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATH_INFO variable to index.php due to insufficient validation for the time_zone object in the HOME_MEETING& page.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patches or updates provided by Mitel to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2020shoretelxssmitelvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:h:mitel:shoretel:-:*:*:*:*:*:*:*
FOFA: body="ShoreTel" && icon_hash="268280373"
https://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html https://www.mitel.com/articles/what-happened-shoretel-products https://nvd.nist.gov/vuln/detail/CVE-2020-28351 http://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html https://github.com/dievus/cve-2020-28351

Source: ProjectDiscovery

References

4