PT-2019-15873 · Sangoma · Freepbx

Publicado 2019-12-06 · Atualizado 2019-12-11 · CVE-2019-19551

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sangoma FreePBX userman versions 13.0.76.43 through 15.0.20

Description A security issue exists in the User Management screen of the Administrator web site, where an attacker with access to the User Control Panel application can submit malicious values in time/date formatting and time-zone fields. These fields are not properly sanitized, allowing for malicious code execution when a user, such as an admin, views the affected user's profile.

Recommendations For Sangoma FreePBX userman versions 13.0.76.43 through 15.0.20, consider restricting access to the User Management screen until a proper fix is applied, and ensure that all input fields, especially time/date formatting and time-zone fields, are properly sanitized to prevent malicious code execution.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19551

Produtos afetados

Freepbx

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-19551 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19551 · Nota de Segurança
• https://wiki.freepbx.org/display/FOP/2019-12-03+Multiple+XSS+Vulnerabilities · Aviso do Fabricante