CVE-2019-16982: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\accesscontrols\accesscontrolnodes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·03:11 PM
Data Sourced
via MITRE·03:11 PM
Description
Frequently Asked Questions
1
What is CVE-2019-16982?
CVE-2019-16982 is a vulnerability in FusionPBX up to v4.5.7 that allows for XSS due to unsanitized input in the 'access_control_nodes.php' file.
2
How severe is CVE-2019-16982?
CVE-2019-16982 has a severity value of 6.1, categorizing it as a medium-severity vulnerability.
3
What is the Common Weakness Enumeration (CWE) for CVE-2019-16982?
The CWE associated with CVE-2019-16982 is CWE-79, which relates to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').