Cross-Site Scripting Vulnerability in FusionPBX by FusionPBX
CVE-2019-19384

6.1MEDIUM

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
29 November 2019

What is CVE-2019-19384?

A cross-site scripting (XSS) flaw exists in the FusionPBX application found in the file app/fax/fax_log_view.php. This vulnerability enables remote attackers to execute arbitrary JavaScript or HTML code by manipulating the fax_uuid parameter. Unsuspecting users interacting with affected instances may unknowingly engage with malicious scripts, elevating the risk of data theft, session hijacking, or other malicious activities.

References

https://gist.github.com/xax007/28e7326acfae677be0b3512168...
x_refsource_MISC
https://github.com/fusionpbx/fusionpbx/commit/aea1abaeb12...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.