CVE-2019-16965: OS Command Injection
Published Oct 21, 2019
·Updated
resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Event History
Oct 21, 2019
CVE Published
via MITRE·06:45 PM
Data Sourced
via MITRE·06:45 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2019-16965.
2
What is the severity of CVE-2019-16965?
The severity of CVE-2019-16965 is critical with a score of 7.2.
3
What is the affected software?
The affected software is FusionPBX up to version 4.5.7.
4
How does CVE-2019-16965 affect the system?
CVE-2019-16965 allows authenticated administrative attackers to execute any commands on the host as www-data.
5
How can I fix CVE-2019-16965?
To fix CVE-2019-16965, update FusionPBX to version 4.5.8 or later, and ensure that input validation is implemented.