CVE-2019-16973: XSS
Published Oct 22, 2019
·Updated
In FusionPBX up to 4.5.7, the file app\contacts\contactedit.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 22, 2019
CVE Published
via MITRE·09:41 PM
Data Sourced
via MITRE·09:41 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16973?
CVE-2019-16973 has been classified as a medium severity vulnerability due to its potential for XSS attacks.
2
How do I fix CVE-2019-16973?
To fix CVE-2019-16973, you should update FusionPBX to a version later than 4.5.7 where the issue has been addressed.
3
What type of vulnerability is CVE-2019-16973?
CVE-2019-16973 is classified as a Cross-Site Scripting (XSS) vulnerability.
4
Which versions of FusionPBX are affected by CVE-2019-16973?
FusionPBX versions up to and including 4.5.7 are affected by CVE-2019-16973.
5
Can CVE-2019-16973 allow unauthorized access to user data?
Yes, CVE-2019-16973 could allow unauthorized access to user data through reflected XSS attacks.