CVE-2020-28351

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-11-09 · updated 2026-06-17
Weakness: CWE-79

Description

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page.

Affected products

Mitel Shoretel Firmware: 19.46.1802.0

References

http://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html
https://github.com/dievus/cve-2020-28351
https://www.mitel.com/articles/what-happened-shoretel-products
http://packetstormsecurity.com/files/159987/ShoreTel-Conferencing-19.46.1802.0-Cross-Site-Scripting.html
https://github.com/dievus/cve-2020-28351
https://www.mitel.com/articles/what-happened-shoretel-products

Get alerted when CVE-2020-28351 or the next vulnerability affects your stack