CVE-2019-16986 - In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it

Back Back to CVE browser

MEDIUM

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it

Published Oct 21, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 1.41%

Description

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7463
Advisory
https://github.com/fusionpbx/fusionpbx/commit/9482d9ee0e4287df21339be4276125e38e048951
x_refsource_MISCNot Applicable
https://github.com/fusionpbx/fusionpbx/commit/9c61191049c949e01f99ea1fbab1feb44709e108
x_refsource_MISCNot Applicable
https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-2/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7463		Advisory
https://github.com/fusionpbx/fusionpbx/commit/9482d9ee0e4287df21339be4276125e38e048951		x_refsource_MISCNot Applicable
https://github.com/fusionpbx/fusionpbx/commit/9c61191049c949e01f99ea1fbab1feb44709e108		x_refsource_MISCNot Applicable
https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-2/		x_refsource_MISCThird Party Advisory