CVE-2019-11407 - app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information

Back Back to CVE browser

HIGH

app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information

Published Jun 17, 2019

7.2

HIGH

CVSS 3.0

EPSS 1.54%

Description

app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html
x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3082
Advisory
https://github.com/fusionpbx/fusionpbx/commit/f38676b7b63bb1ec3a68d577fe23e6701f482aef
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html		x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3082		Advisory
https://github.com/fusionpbx/fusionpbx/commit/f38676b7b63bb1ec3a68d577fe23e6701f482aef		x_refsource_MISCPatchThird Party Advisory