CVE-2019-16986: Path Traversal
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\securedownload.php is also affected.)
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Event History
Oct 21, 2019
CVE Published
via MITRE·03:38 PM
Data Sourced
via MITRE·03:38 PM
Description
Frequently Asked Questions
1
What is CVE-2019-16986?
CVE-2019-16986 is a vulnerability in FusionPBX up to v4.5.7 that allows a download of any pathname.
2
How does CVE-2019-16986 affect FusionPBX?
CVE-2019-16986 affects FusionPBX up to v4.5.7, specifically the file resources\download.php and resources\secure_download.php.
3
What is the severity of CVE-2019-16986?
CVE-2019-16986 has a severity rating of medium with a CVSS score of 6.5.
4
How can I fix CVE-2019-16986 in FusionPBX?
To fix CVE-2019-16986 in FusionPBX, apply the latest patch or update to a version higher than v4.5.7.
5
What is the CWE ID for CVE-2019-16986?
The CWE ID for CVE-2019-16986 is CWE-22.