CVE-2019-16969: XSS
First published: Mon Oct 21 2019(Updated: )
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fusionpbx Fusionpbx | <=4.5.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this FusionPBX vulnerability?
The vulnerability ID for this FusionPBX vulnerability is CVE-2019-16969.
What is the severity rating of CVE-2019-16969?
CVE-2019-16969 has a severity rating of 6.1 (medium).
What is the CWE category for this vulnerability?
The CWE category for CVE-2019-16969 is CWE-79 (Cross-Site Scripting).
How does CVE-2019-16969 affect FusionPBX?
CVE-2019-16969 affects FusionPBX up to version 4.5.7.
Is there a fix available for CVE-2019-16969?
Yes, a fix for CVE-2019-16969 is available. Please refer to the provided references for more information.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/fusionpbx
- canonical/fusionpbx fusionpbx
- version/fusionpbx fusionpbx/4.5.7