CVE-2019-16974: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to 4.5.7, the file app\contacts\contacttimes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·08:45 PM
Data Sourced
via MITRE·08:45 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16974?
The severity of CVE-2019-16974 is considered medium due to its potential for cross-site scripting (XSS).
2
How do I fix CVE-2019-16974?
To fix CVE-2019-16974, ensure you sanitize the 'id' variable in app\contacts\contact_times.php to prevent XSS vulnerabilities.
3
Which versions of FusionPBX are affected by CVE-2019-16974?
FusionPBX versions up to and including 4.5.7 are affected by CVE-2019-16974.
4
What type of vulnerability is CVE-2019-16974?
CVE-2019-16974 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2019-16974 be exploited remotely?
Yes, CVE-2019-16974 can be exploited remotely due to the unsanitized input in a publicly accessible file.