VulnerabilityModified

CVE-2021-31583

MEDIUM 5.4EPSS 1.12%

Does this matter?

Lower severity and a low EPSS score (1.12%). Track it; it rarely justifies an emergency change on its own.

Description

Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang).

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.12% probability · 64th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: sipwise/next generation communication platform
Source: cve@mitre.org

References

http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.htmlExploit, Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/162316/Sipwise-C5-NGCP-CSC-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.sipwise.comProduct
https://www.zeroscience.mk/en/vulnerabilitiesExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5648.phpExploit, Third Party Advisory
http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.htmlExploit, Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/162316/Sipwise-C5-NGCP-CSC-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.sipwise.comProduct
https://www.zeroscience.mk/en/vulnerabilitiesExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5648.phpExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.