CVE-2019-16968: XSS
Published Oct 21, 2019
·Updated
An issue was discovered in FusionPBX up to 4.5.7. In the file app\conferencecontrols\conferencecontroldetails.php, an unsanitized id variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·07:30 PM
Data Sourced
via MITRE·07:30 PM
Description
Frequently Asked Questions
1
What is the CVE ID of the vulnerability in FusionPBX up to version 4.5.7?
The CVE ID of the vulnerability in FusionPBX up to version 4.5.7 is CVE-2019-16968.
2
What is the severity of CVE-2019-16968?
The severity of CVE-2019-16968 is rated as medium with a CVSS score of 6.1.
3
How is the XSS vulnerability triggered in FusionPBX up to version 4.5.7?
The XSS vulnerability is triggered by an unsanitized 'id' variable from the URL being reflected in HTML on two occasions in the file conference_control_details.php.