CVE-2019-16979: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\contacts\contacturls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·02:15 PM
Data Sourced
via MITRE·02:15 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16979?
CVE-2019-16979 is classified as a high severity vulnerability due to the potential for cross-site scripting attacks.
2
How do I fix CVE-2019-16979?
To fix CVE-2019-16979, update FusionPBX to version 4.5.8 or later, which addresses the XSS vulnerability.
3
What type of vulnerability is CVE-2019-16979?
CVE-2019-16979 is an XSS (Cross-Site Scripting) vulnerability caused by unsanitized input from the URL.
4
Which versions of FusionPBX are affected by CVE-2019-16979?
Versions of FusionPBX up to and including 4.5.7 are affected by CVE-2019-16979.
5
What impact does CVE-2019-16979 have on users?
CVE-2019-16979 can allow attackers to execute arbitrary JavaScript in the context of an authenticated user, potentially leading to data theft or session hijacking.