CVE-2019-16985: Path Traversal
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\xmlcdr\xmlcdrdelete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file of the system.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·03:27 PM
Data Sourced
via MITRE·03:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16985?
CVE-2019-16985 has been assigned a medium severity rating due to the potential for arbitrary file deletion.
2
How do I fix CVE-2019-16985?
To fix CVE-2019-16985, upgrade to FusionPBX version 4.5.8 or later, where the vulnerability is addressed.
3
What impact does CVE-2019-16985 have on affected systems?
CVE-2019-16985 allows an attacker to delete any file on the server, leading to potential data loss and service disruption.
4
Which versions of FusionPBX are affected by CVE-2019-16985?
CVE-2019-16985 affects FusionPBX versions up to and including 4.5.7.
5
Is there a known exploit for CVE-2019-16985?
Yes, CVE-2019-16985 has been discussed in various blog posts detailing how the vulnerability can be exploited.