Cross-Site Scripting in Sangoma FreePBX User Management

CVE-2019-19551

What is CVE-2019-19551?

In Sangoma FreePBX versions 13.0.76.43 through 15.0.20, a security flaw exists in the User Management screen where inadequate sanitization of user inputs allows an attacker to inject malicious scripts. An attacker having access to the User Control Panel can exploit this vulnerability by entering harmful data into specific time/date formatting and time-zone fields. When an administrator or authorized user accesses the affected User Management screen to view profiles, the embedded malicious script executes in the context of the victim user's account, potentially compromising their security and data integrity.

References