Command Injection Vulnerability in FusionPBX Operator Panel by FusionPBX
CVE-2019-11409

8.8HIGH

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
17 June 2019

What is CVE-2019-11409?

The Operator Panel module in FusionPBX version 4.4.3 contains a command injection vulnerability within app/operator_panel/exec.php. This flaw allows authenticated non-administrative users to execute arbitrary commands on the host system due to insufficient input validation. The vulnerability's severity is compounded by the presence of an existing cross-site scripting (XSS) vulnerability in the same module, possibly leading to remote code execution.

References

https://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d...
x_refsource_MISC
http://packetstormsecurity.com/files/153256/FusionPBX-4.4...
x_refsource_MISC
https://blog.gdssecurity.com/labs/2019/6/7/rce-using-call...
x_refsource_MISC

EPSS Score

87% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.