Login Request a demo
Medium severity · published Oct 21, 2019
CVE-2019-16967
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3
6.1
CVSS
1.3%
EPSS
No
On KEV
Description
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Freepbx · Sangoma
before 14.0.10.3 · source: NVD
MA
Manager · Freepbx
13.0.2 before 13.0.2.6; 15.0.2 before 15.0.6; 13.0.1 · source: NVD
Affected product
MA
Manager
Freepbx
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16967
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16967
Patch
https://github.com/FreePBX/manager/commit/071a50983ca6a373bb2d1d3db68e9eda4667a372
Exploit
https://issues.freepbx.org/browse/FREEPBX-20436
Patch
https://resp3ctblog.wordpress.com/2019/10/19/freepbx-xss-2/