CVE-2019-16971: XSS
Published Oct 22, 2019
·Updated
In FusionPBX up to 4.5.7, the file app\messages\messagesthread.php uses an unsanitized "contactuuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 22, 2019
CVE Published
via MITRE·09:16 PM
Data Sourced
via MITRE·09:16 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16971?
CVE-2019-16971 is classified as a high-severity vulnerability due to its potential for XSS attacks.
2
How do I fix CVE-2019-16971?
To fix CVE-2019-16971, upgrade FusionPBX to version 4.5.8 or later where the vulnerability is patched.
3
What type of vulnerability is CVE-2019-16971?
CVE-2019-16971 is a Cross-Site Scripting (XSS) vulnerability that affects FusionPBX.
4
Which versions of FusionPBX are affected by CVE-2019-16971?
FusionPBX versions up to and including 4.5.7 are affected by CVE-2019-16971.
5
What impact does CVE-2019-16971 have on users?
CVE-2019-16971 allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising their data.