The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote…
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Zenitel
- Product
- Zenitel Connect
- CVSS v4.0
- 5.1 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-1021
- NVD status
- Received
Why it ranks 18 (Routine)
- CVSS v4.0 5.1 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.