CVE-2019-19615

low-risk
Published 2020-03-16

Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, the XSS payload will render and execute in the context of the victim user's account.

Do I need to act?

-
0.31% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.8/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Sangoma

References (4)

Vendor Advisory https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities
Vendor Advisory https://wiki.freepbx.org/pages/viewpage.action?pageId=175177911
Vendor Advisory https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities
Vendor Advisory https://wiki.freepbx.org/pages/viewpage.action?pageId=175177911
25
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal