CVE-2019-16967: XSS
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-16967?
CVE-2019-16967 is a vulnerability in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 in FreePBX 14.0.10.3 that allows for cross-site scripting (XSS) attacks.
How severe is CVE-2019-16967?
CVE-2019-16967 has a severity rating of 6.1, which is considered medium.
What software is affected by CVE-2019-16967?
Freepbx Manager versions 13.x before 13.0.2.6, 15.x before 15.0.6, and 13.0.1-alpha1, as well as Sangoma FreePBX up to version 14.0.10.3, are affected by CVE-2019-16967.
How can I fix CVE-2019-16967?
Upgrade to Manager 13.0.2.6 or later for version 13.x, upgrade to Manager 15.0.6 or later for version 15.x, upgrade to Manager 13.0.2 or later for version 13.0.1-alpha1, or upgrade to a version of Sangoma FreePBX later than 14.0.10.3.
Can CVE-2019-16967 be exploited remotely?
Yes, CVE-2019-16967 can be exploited remotely.