CVE-2007-2191 - CVE House
Back to Database
Status published Medium CVE-2007-2191

Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-2191

Credits & Attribution

No credits recorded in the NVD database.

References

More from freepbx

View All →
CVE-2019-16967
An issue was discovered in Manager 13.x before 13.0.2.6 and...
Medium 6.1
CVE-2019-16966
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x...
Medium 6.1
CVE-2018-15892
FreePBX 13 and 14 has SQL Injection in the DISA...
Medium 4.3
CVE-2018-15891
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34,...
Medium 4.8
CVE-2014-7235
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in...
Critical 10

Affected Vendor

Affected Software

freepbx
Vulnerable Versions:
2.2.1, 2.2_rc1

Timeline

Official Publish: April 24th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.