CVE-2019-16983: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function (called by several pages of the interface), which uses an unsanitized "param" variable constructed partially from the URL args and reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·03:20 PM
Data Sourced
via MITRE·03:20 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16983?
The severity of CVE-2019-16983 is rated as medium with a CVSS score of 6.1.
2
How can I fix the XSS vulnerability in FusionPBX up to v4.5.7 (CVE-2019-16983)?
To fix the XSS vulnerability in FusionPBX up to v4.5.7 (CVE-2019-16983), sanitize the "param" variable properly before reflecting it in HTML to prevent XSS attacks.