CVE-2019-16984: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\recordings\recordingplay.php uses an unsanitized "filename" variable coming from the URL, which is base64 decoded and reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·03:23 PM
Data Sourced
via MITRE·03:23 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16984?
CVE-2019-16984 is classified as a medium severity vulnerability due to its potential exploitation via reflected XSS.
2
How do I fix CVE-2019-16984?
To fix CVE-2019-16984, sanitize the 'filename' variable in app/recordings/recording_play.php before using it in HTML output.
3
What type of vulnerability is CVE-2019-16984?
CVE-2019-16984 is a reflected cross-site scripting (XSS) vulnerability.
4
Which versions of FusionPBX are affected by CVE-2019-16984?
CVE-2019-16984 affects FusionPBX versions up to and including v4.5.7.
5
Can CVE-2019-16984 lead to data exposure?
Yes, CVE-2019-16984 can potentially lead to data exposure through malicious XSS attacks on users.