CVE-2019-11407: Infoleak

Published Jun 17, 2019

Updated

app/operatorpanel/indexinc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information.

Affected Software

1 affected component

FusionPBX Fusionpbx=4.4.3

Remediation

Patch Available

https://github.com/fusionpbx/fusionpbx/commit/f38676b7b63bb1ec3a68d577fe23e6701f482aef

Event History

Jun 17, 2019

CVE Published

via MITRE·05:56 PM

Data Sourced

via MITRE·05:56 PM

Description

Frequently Asked Questions

What is CVE-2019-11407?

CVE-2019-11407 is a vulnerability in the Operator Panel module in FusionPBX 4.4.3 that allows authenticated administrative attackers to obtain credentials and other sensitive information.

How severe is CVE-2019-11407?

CVE-2019-11407 has a severity rating of 7.2, considered high.

How can an attacker exploit CVE-2019-11407?

An attacker can exploit CVE-2019-11407 by accessing the app/operator_panel/index_inc.php page and obtaining excessive debug information, which includes credentials and sensitive data.

Which version of FusionPBX is affected by CVE-2019-11407?

CVE-2019-11407 affects FusionPBX version 4.4.3.

Is there a patch or fix available for CVE-2019-11407?

Yes, a fix for CVE-2019-11407 is available. Please refer to the official FusionPBX GitHub repository for the commit that addresses the vulnerability.