CVE-2019-16976: XSS
Published Oct 23, 2019
·Updated
In FusionPBX up to 4.5.7, the file app\destinations\destinationimports.php uses an unsanitized "querystring" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 23, 2019
CVE Published
via MITRE·02:34 PM
Data Sourced
via MITRE·02:34 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16976?
CVE-2019-16976 is classified as a high severity vulnerability due to its potential for XSS attacks.
2
How do I fix CVE-2019-16976?
To fix CVE-2019-16976, update FusionPBX to version 4.5.8 or later to ensure query strings are properly sanitized.
3
What types of attacks can CVE-2019-16976 lead to?
CVE-2019-16976 can lead to cross-site scripting (XSS) attacks, allowing attackers to inject malicious scripts into web pages.
4
Which versions of FusionPBX are affected by CVE-2019-16976?
CVE-2019-16976 affects all versions of FusionPBX up to and including 4.5.7.
5
Is CVE-2019-16976 being actively exploited?
At the time of documentation, there have been no confirmed reports of active exploitation of CVE-2019-16976.