CVE-2019-16991: XSS
Published Oct 21, 2019
·Updated
In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected Software
1 affected component
FusionPBX Fusionpbx<=4.5.7
Remediation
Event History
Oct 21, 2019
CVE Published
via MITRE·03:45 PM
Data Sourced
via MITRE·03:45 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16991?
The severity of CVE-2019-16991 is rated as medium with a CVSS score of 6.1.
2
How does CVE-2019-16991 impact FusionPBX up to version 4.5.7?
CVE-2019-16991 impacts FusionPBX up to version 4.5.7 by allowing XSS attacks through the unsanitized 'file' variable in the file app\edit\filedelete.php.
3
How can I fix the XSS vulnerability in FusionPBX related to CVE-2019-16991?
To fix the XSS vulnerability in FusionPBX related to CVE-2019-16991, update to a version beyond 4.5.7 that contains the necessary security patches.