CVE-2019-16968 - An issue was discovered in FusionPBX up to 4.5.7

Back Back to CVE browser

MEDIUM

An issue was discovered in FusionPBX up to 4.5.7

Published Oct 21, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 0.82%

Description

An issue was discovered in FusionPBX up to 4.5.7. In the file app\conference_controls\conference_control_details.php, an unsanitized id variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7445
Advisory
https://github.com/fusionpbx/fusionpbx/commit/02378c54722d89f875c66ddb00ff06468dabbc6d
x_refsource_MISCPatch
https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-1/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7445		Advisory
https://github.com/fusionpbx/fusionpbx/commit/02378c54722d89f875c66ddb00ff06468dabbc6d		x_refsource_MISCPatch
https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-1/		x_refsource_MISCThird Party Advisory