Cross-Site Scripting Vulnerability in FusionPBX by FusionPBX
CVE-2019-19386

6.1MEDIUM

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
29 November 2019

What is CVE-2019-19386?

A cross-site scripting vulnerability exists in the voicemail_greeting_edit.php file of FusionPBX version 4.4.1. This flaw allows remote attackers to inject arbitrary web scripts or HTML through the 'id' and/or 'voicemail_id' parameters. Exploiting this vulnerability could lead to unauthorized access or manipulation of web content, posing serious risks to the integrity and confidentiality of user interactions within the application.

References

https://gist.github.com/xax007/28e7326acfae677be0b3512168...
x_refsource_MISC
https://github.com/fusionpbx/fusionpbx/commit/9e837fadecd...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.