Security readout for executives and security teams
Plain-English summary
CVE-2023-37190 is a stored XSS issue in Issabel PBX v4.0.0-6. Malicious script or HTML can be saved in New Virtual Fax fields and later run in a user’s browser. Business risk depends on who can access that feature and whether administrators view the stored data.
Executive priority
Treat this as a moderate-priority web application risk for affected Issabel PBX systems. Prioritize if the PBX web interface is broadly accessible or if low-trust users can create virtual fax entries.
Technical view
The CVE describes stored cross-site scripting through the Virtual Fax Name and Caller ID Name parameters in Issabel issabel-pbx v4.0.0-6. The public bundle does not provide CVSS, CWE mapping, a vendor advisory, or confirmed affected CPEs.
Likely exposure
Exposure is most likely in Issabel PBX v4.0.0-6 deployments with the New Virtual Fax feature enabled or accessible to users. Internet exposure is not established by the sources.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. Public proof material is referenced on GitHub, but the provided evidence supports only the vulnerability description, not exploitation in the wild.
Researcher notes
Evidence is thin: no CVSS, CWE, CPE, vendor fix, or KEV signal is included. Avoid assuming broader Issabel versions are affected unless confirmed by vendor or additional primary sources.
Mitigation direction
- Check Issabel vendor guidance for patched versions or official workarounds.
- Restrict PBX administrative and fax-management access to trusted users only.
- Review Virtual Fax Name and Caller ID Name values for unexpected HTML or script content.
- Remove suspicious stored values after preserving evidence for incident review.
- Harden session controls and monitor privileged PBX web activity.
Validation and detection
- Inventory Issabel PBX deployments and identify any v4.0.0-6 instances.
- Confirm whether New Virtual Fax is enabled and who can access it.
- Inspect existing virtual fax records for unsafe HTML-like content.
- Verify vendor guidance before applying upgrades or configuration changes.
- Review access logs for unusual changes to virtual fax settings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-37190 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://reference2.example.com/index.php?menu=grouplistCVE reference
- https://github.com/sahiloj/CVE-2023-37190/blob/main/README.mdCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.