CVE-2019-16989: XSS
In FusionPBX up to v4.5.7, the file app\conferencesactive\conferenceinteractive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-16989?
CVE-2019-16989 is a vulnerability in FusionPBX up to v4.5.7 that allows for XSS attacks through unsanitized input.
How does CVE-2019-16989 affect FusionPBX?
CVE-2019-16989 affects FusionPBX up to v4.5.7 by allowing XSS attacks through an unsanitized 'c' variable in the URL.
What is the severity of CVE-2019-16989?
CVE-2019-16989 has a severity level of medium (6.1).
How can I fix CVE-2019-16989 in FusionPBX?
To fix CVE-2019-16989 in FusionPBX, you should update to a version beyond v4.5.7.
Where can I find more information about CVE-2019-16989?
You can find more information about CVE-2019-16989 at the following references: [link1](https://github.com/fusionpbx/fusionpbx/commit/83123e314a2e4c2dd0815446f89bcad97278d98d), [link2](https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-19/).