CVE-2019-16968: XSS
First published: Mon Oct 21 2019(Updated: )
An issue was discovered in FusionPBX up to 4.5.7. In the file app\conference_controls\conference_control_details.php, an unsanitized id variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fusionpbx Fusionpbx | <=4.5.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the CVE ID of the vulnerability in FusionPBX up to version 4.5.7?
The CVE ID of the vulnerability in FusionPBX up to version 4.5.7 is CVE-2019-16968.
What is the severity of CVE-2019-16968?
The severity of CVE-2019-16968 is rated as medium with a CVSS score of 6.1.
How is the XSS vulnerability triggered in FusionPBX up to version 4.5.7?
The XSS vulnerability is triggered by an unsanitized 'id' variable from the URL being reflected in HTML on two occasions in the file conference_control_details.php.
- collector/nvd-index
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/fusionpbx
- canonical/fusionpbx fusionpbx
- version/fusionpbx fusionpbx/4.5.7