PT-2019-15873 · Sangoma · Freepbx

Published 2019-12-06 · Updated 2019-12-11 · CVE-2019-19551

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sangoma FreePBX userman versions 13.0.76.43 through 15.0.20

Description A security issue exists in the User Management screen of the Administrator web site, where an attacker with access to the User Control Panel application can submit malicious values in time/date formatting and time-zone fields. These fields are not properly sanitized, allowing for malicious code execution when a user, such as an admin, views the affected user's profile.

Recommendations For Sangoma FreePBX userman versions 13.0.76.43 through 15.0.20, consider restricting access to the User Management screen until a proper fix is applied, and ensure that all input fields, especially time/date formatting and time-zone fields, are properly sanitized to prevent malicious code execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19551

Affected Products

Freepbx

References · 3

• https://osv.dev/vulnerability/CVE-2019-19551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19551 · Security Note
• https://wiki.freepbx.org/display/FOP/2019-12-03+Multiple+XSS+Vulnerabilities · Vendor Advisory