PT-2019-14911 · Fusionpbx · Fusionpbx

Pierre Jourdan · Published 2019-10-21 · Updated 2023-02-04 · CVE-2019-16990

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FusionPBX versions up to 4.5.7

Description The issue concerns the use of an unsanitized file variable in the music on hold.php file, which allows the download of any pathname, provided it is base64 encoded, when coming from the URL.

Recommendations For FusionPBX versions up to 4.5.7, consider restricting access to the music on hold.php file until a patch is available, or ensure that the file variable is properly sanitized to prevent unauthorized file downloads.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-16990

Affected Products

Fusionpbx

References · 5

• https://github.com/fusionpbx/fusionpbx/commit/95ed18aa9d781f232f5686a9027bb6f677c9b8da · Patch
• https://osv.dev/vulnerability/CVE-2019-16990 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16990 · Security Note
• https://t.me/cvenotify/43603 · Telegram Post
• https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-3 · Note