CVE-2019-16972: XSS
In FusionPBX up to 4.5.7, the file app\contacts\contactaddresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-16972?
CVE-2019-16972 is a vulnerability in FusionPBX up to version 4.5.7 that allows for cross-site scripting (XSS) attacks.
How does CVE-2019-16972 affect FusionPBX?
CVE-2019-16972 affects FusionPBX up to version 4.5.7 by allowing an attacker to execute malicious code through cross-site scripting (XSS).
What is the severity of CVE-2019-16972?
The severity of CVE-2019-16972 is medium, with a CVSSv3 score of 6.1.
How can I fix CVE-2019-16972?
To fix CVE-2019-16972, you should update FusionPBX to version 4.5.8 or higher, which includes a patch for the vulnerability.
Where can I find more information about CVE-2019-16972?
You can find more information about CVE-2019-16972 at the following links: [GitHub Commit](https://github.com/fusionpbx/fusionpbx/commit/913ad234cf145a55e5f2faaab08d776d83c1699b) and [Resp3ct Blog](https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-5/).