CVE-2019-16966: XSS
First published: Mon Oct 21 2019(Updated: )
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Freepbx Contactmanager | >=13.0.2<13.0.45.3 | |
| Freepbx Contactmanager | >=14.0.1.1<14.0.5.12 | |
| Freepbx Contactmanager | >=15.0.2<15.0.8.21 | |
| Freepbx Contactmanager | =13.0.0-beta1 | |
| Freepbx Contactmanager | =13.0.0-beta2 | |
| Freepbx Contactmanager | =13.0.0-beta3 | |
| Freepbx Contactmanager | =13.0.0-beta4 | |
| Freepbx Contactmanager | =13.0.0-beta5 | |
| Freepbx Contactmanager | =14.0.1 | |
| Freepbx Contactmanager | =14.0.1-alpha1 | |
| Freepbx Contactmanager | =14.0.1-alpha2 | |
| Freepbx Contactmanager | =14.0.1-beta1 | |
| Freepbx Contactmanager | =14.0.1-beta2 | |
| Freepbx Contactmanager | =14.0.1-beta3 | |
| Sangoma FreePBX | =14.0.10.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-16966?
CVE-2019-16966 is a vulnerability in Contactmanager in FreePBX versions 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 that allows for reflected XSS attacks.
How does CVE-2019-16966 affect FreePBX?
CVE-2019-16966 affects FreePBX versions 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 by allowing an attacker to execute malicious scripts in a victim's browser.
What is the severity of CVE-2019-16966?
The severity of CVE-2019-16966 is medium, with a CVSS score of 6.1.
How can I fix CVE-2019-16966?
To fix CVE-2019-16966, upgrade to FreePBX versions 13.0.45.3, 14.0.5.12, or 15.0.8.21 or apply the patch provided by FreePBX.
Where can I find more information about CVE-2019-16966?
You can find more information about CVE-2019-16966 in the references section: [reference 1](https://github.com/FreePBX/contactmanager/commit/99e5aa0050224289cfe64c9036f38ce2531bf633), [reference 2](https://issues.freepbx.org/browse/FREEPBX-20437), [reference 3](https://resp3ctblog.wordpress.com/2019/10/19/freepbx-xss-1/).
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/freepbx
- canonical/freepbx contactmanager
- version/freepbx contactmanager/13.0.2
- version/freepbx contactmanager/14.0.1.1
- version/freepbx contactmanager/15.0.2
- version/freepbx contactmanager/13.0.0-beta1
- version/freepbx contactmanager/13.0.0-beta2
- version/freepbx contactmanager/13.0.0-beta3
- version/freepbx contactmanager/13.0.0-beta4
- version/freepbx contactmanager/13.0.0-beta5
- version/freepbx contactmanager/14.0.1
- version/freepbx contactmanager/14.0.1-alpha1
- version/freepbx contactmanager/14.0.1-alpha2
- version/freepbx contactmanager/14.0.1-beta1
- version/freepbx contactmanager/14.0.1-beta2
- version/freepbx contactmanager/14.0.1-beta3
- vendor/sangoma
- canonical/sangoma freepbx
- version/sangoma freepbx/14.0.10.3