CVE-2019-16987: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\contacts\contactimport.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16987?
CVE-2019-16987 has a moderate severity rating due to its potential for cross-site scripting (XSS) exploits.
2
How do I fix CVE-2019-16987?
To fix CVE-2019-16987, upgrade FusionPBX to version 4.5.8 or later, where the vulnerability has been patched.
3
What type of vulnerability is CVE-2019-16987?
CVE-2019-16987 is a cross-site scripting (XSS) vulnerability that arises from unsanitized user input.
4
Which versions of FusionPBX are affected by CVE-2019-16987?
CVE-2019-16987 affects FusionPBX versions up to and including 4.5.7.
5
Can CVE-2019-16987 be exploited remotely?
Yes, CVE-2019-16987 can be exploited remotely since it involves user input from the URL.