{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-23387"
      ],
      "details": "FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product.",
      "id": "GSD-2024-23387",
      "modified": "2024-01-16T06:02:04.327973Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2024-23387",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "FusionPBX",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "prior to 5.1.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "FusionPBX"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Cross-site scripting (XSS)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.fusionpbx.com/",
            "refsource": "MISC",
            "url": "https://www.fusionpbx.com/"
          },
          {
            "name": "https://github.com/fusionpbx/fusionpbx/",
            "refsource": "MISC",
            "url": "https://github.com/fusionpbx/fusionpbx/"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN67215338/",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN67215338/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fusionpbx:fusionpbx:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D7E38EB-BDA8-4715-B097-772651C501D8",
                    "versionEndExcluding": "5.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product."
          },
          {
            "lang": "es",
            "value": "FusionPBX anterior a 5.1.0 contiene una vulnerabilidad de Cross-Site Scripting. Si esta vulnerabilidad es aprovechada por un atacante remoto autenticado con privilegios administrativos, se puede ejecutar un script arbitrario en el navegador web del usuario que inicia sesi\u00f3n en el producto."
          }
        ],
        "id": "CVE-2024-23387",
        "lastModified": "2024-01-25T02:00:29.210",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.7,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-01-19T04:15:09.987",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/fusionpbx/fusionpbx/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/jp/JVN67215338/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Product"
            ],
            "url": "https://www.fusionpbx.com/"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}