CVE-2019-19615: XSS
Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, the XSS payload will render and execute in the context of the victim user's account.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the XSS vulnerabilities in the Backup & Restore module of FreePBX?
The vulnerability ID for the XSS vulnerabilities in the Backup & Restore module of FreePBX is CVE-2019-19615.
What is the severity rating for CVE-2019-19615?
The severity rating for CVE-2019-19615 is medium with a score of 4.8.
How can an attacker exploit CVE-2019-19615?
An attacker can exploit CVE-2019-19615 by modifying the id parameter of the backup configuration screen and embedding malicious XSS code.
What is the affected software for CVE-2019-19615?
The affected software for CVE-2019-19615 is Sangoma FreePBX versions 14.0.10.2 through 14.0.10.7.
Is there a fix available for CVE-2019-19615?
Yes, it is recommended to update FreePBX to a version that includes the fix for CVE-2019-19615.