Headline
CVE-2019-16989: FusionPBX XSS 19
In FusionPBX up to v4.5.7, the file app\conferences_active\conference_interactive.php uses an unsanitized “c” variable coming from the URL, which is reflected in HTML, leading to XSS.
Skip to content
An attacker targeting an authenticated user can push him to click on a URL of FusionPBX 4.5.7 specially crafted to get javascript code executed in his browser.
In FusionPBX up to v4.5.7, file app\conferences_active\conference_interactive.php uses an unsanitized “c” variable coming from the URL which is reflected in HTML leading to XSS.
Bug ID: https://www.fusionpbx.com/app/tickets/ticket_edit.php?id=e7d9acc9-d629-4f7c-adef-dd95344fdb9f
Fix: https://github.com/fusionpbx/fusionpbx/commit/83123e314a2e4c2dd0815446f89bcad97278d98d
Issue was reported by Pierre Jourdan on 10/08/2019 and fixed on same day by Mark J Crane.
CVE published, NVD base score is 6.1 MEDIUM:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16989
https://nvd.nist.gov/vuln/detail/CVE-2019-16989