CVE-2019-16977: XSS
Published Oct 23, 2019
·Updated
In FusionPBX up to 4.5.7, the file app\extensions\extensionimports.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 23, 2019
CVE Published
via MITRE·04:27 PM
Data Sourced
via MITRE·04:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16977?
CVE-2019-16977 has a medium severity rating due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2019-16977?
To fix CVE-2019-16977, upgrade FusionPBX to version 4.5.8 or later where the vulnerability has been addressed.
3
What versions of FusionPBX are affected by CVE-2019-16977?
FusionPBX versions up to and including 4.5.7 are affected by CVE-2019-16977.
4
What type of vulnerability is CVE-2019-16977?
CVE-2019-16977 is a cross-site scripting (XSS) vulnerability.
5
What is the impact of CVE-2019-16977?
The impact of CVE-2019-16977 allows an attacker to execute arbitrary scripts in the context of a user's browser.