medium6.1
CVE-2019-16991
In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS.
Impact
In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fusionpbx | Fusionpbx | through 4.5.7 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/fusionpbx/fusionpbx/commit/cd4632b46c62855f7e1c1c93d20ffd64edcb476e
- https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-20/
- https://github.com/fusionpbx/fusionpbx/commit/cd4632b46c62855f7e1c1c93d20ffd64edcb476e
- https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-20/