CVE-2019-16966

Published: Oct 21, 2019Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.

Affected (15)

Products: Freepbx: Contactmanager · Sangoma: Freepbx

1 product

1 product

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Freepbx Contactmanager	From 13.0.2 to 13.0.45.3
Freepbx Contactmanager	From 14.0.1.1 to 14.0.5.12
Freepbx Contactmanager	From 15.0.2 to 15.0.8.21
Freepbx Contactmanager	Version 13.0.0 beta1
Freepbx Contactmanager	Version 13.0.0 beta2
Freepbx Contactmanager	Version 13.0.0 beta3
Freepbx Contactmanager	Version 13.0.0 beta4
Freepbx Contactmanager	Version 13.0.0 beta5
Freepbx Contactmanager	Version 14.0.1
Freepbx Contactmanager	Version 14.0.1 alpha1
Freepbx Contactmanager	Version 14.0.1 alpha2
Freepbx Contactmanager	Version 14.0.1 beta1
Freepbx Contactmanager	Version 14.0.1 beta2
Freepbx Contactmanager	Version 14.0.1 beta3
Sangoma Freepbx	Version 14.0.10.3