CVE-2019-16966

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3

published October 21, 2019

CVSS
—
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01140 · 66.4th percentile
Published
2019-10-21T18:57Z
EPSS history
Timeline
  • 21 OCT 18:57Z
    An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3
    cvelistv5