CVE-2019-19386: XSS
Published Nov 28, 2019
·Updated
A cross-site scripting (XSS) vulnerability in app/voicemailgreetings/voicemailgreetingedit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id and/or voicemailid parameter.
Affected Software
1 affected component
FusionPBX Fusionpbx=4.4.1
Remediation
Event History
Nov 28, 2019
CVE Published
via MITRE·11:56 PM
Data Sourced
via MITRE·11:56 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-19386?
CVE-2019-19386 is classified with a medium severity due to its potential for cross-site scripting attacks.
2
How does CVE-2019-19386 allow exploitation?
CVE-2019-19386 allows exploitation through the injection of arbitrary web scripts or HTML via the id and voicemail_id parameters.
3
What versions of FusionPBX are affected by CVE-2019-19386?
CVE-2019-19386 affects FusionPBX version 4.4.1.
4
How can I fix CVE-2019-19386?
To mitigate CVE-2019-19386, it is recommended to update FusionPBX to the latest version or apply security patches.
5
What types of attacks can CVE-2019-19386 facilitate?
CVE-2019-19386 facilitates cross-site scripting (XSS) attacks that could compromise user data and session integrity.