CVE-2019-16978: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\devices\devicesettings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·02:01 PM
Data Sourced
via MITRE·02:01 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16978?
CVE-2019-16978 is classified as a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2019-16978?
To fix CVE-2019-16978, upgrade FusionPBX to version 4.5.8 or later where the issue has been addressed.
3
What type of vulnerability is CVE-2019-16978?
CVE-2019-16978 is an XSS vulnerability that allows attackers to inject malicious scripts into web pages.
4
Which versions of FusionPBX are affected by CVE-2019-16978?
FusionPBX versions up to and including 4.5.7 are vulnerable to CVE-2019-16978.
5
What is the impact of CVE-2019-16978 on users?
CVE-2019-16978 could allow attackers to execute arbitrary scripts in the context of the user's web browser, compromising user data.