In response to the security advisory issued by the Spanish National Cybersecurity Institute (INCIBE) under ID INC-2025-0012, we inform the public that the reported vulnerability in Issabel v5.0.0 has been identified, fixed, and resolved through official package updates.
Type: Stored Cross Site Scripting (XSS)
CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation
Vector: Sending a POST request to /index.php?menu=conference using the conference_number parameter.
Potential Impact: Under certain conditions, an authenticated attacker could craft a malicious request that, if accessed by another authenticated user, may lead to session cookie exposure.
CVSS v3.1 Base Score: 5.4
Affected Products: Issabel v5.0.0
Date Reported to Issabel: January 2025
While this vulnerability received a medium severity rating, its real-world exploitability is considered very low due to restrictions on executable code and required access levels.
On February 10, 2025, the Issabel development team released updated packages that address the issue:
issabel-pbx version 5.0.0-4
issabel-agenda version 5.0.0-2
These packages implement stricter input validation for the affected parameter. The updates are now available through the official updates repository.
yum update issabel-pbx issabel-agenda
Comprehensive functional testing was conducted in a controlled environment, confirming that:
We thank INCIBE for its responsible disclosure and collaboration in this process. Their proactive communication helps strengthen the security of the open-source ecosystem and mission-critical communication platforms.
The Issabel Team
“I am honored to recognize Issabel, LLC with a 2023 Product of the Year Award for its commitment to excellence and innovation,” said Rich Tehrani, CEO, TMC.
Issabel® is developed and managed by Issabel® LLC. company formed by a group of professionals from different countries.
Our team is a leader in open source innovation with implementations and success stories in different continents. Our experience in developing these technologies has allowed us to develop, maintain and improve unified communications platforms.