Cross-Site Scripting Vulnerability in FusionPBX by FusionPBX
CVE-2019-19367

6.1MEDIUM

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
27 November 2019

What is CVE-2019-19367?

A cross-site scripting vulnerability in the FusionPBX application allows remote attackers to inject arbitrary web scripts or HTML into the system via the 'id' parameter in the fax_files.php file. This flaw could lead to malicious scripts being executed in the context of the user’s browser, potentially compromising sensitive information and user sessions.

References

https://gist.github.com/xax007/94183b11bdfe579fd860a37e74...
x_refsource_MISC
https://github.com/fusionpbx/fusionpbx/commit/72a5ce4d2d6...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.