CVE-2019-16967

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3

published October 21, 2019

CVSS
—
EPSS
1%
Percentile
70.4
In the wild
Unconfirmed
What it is

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01311 · 70.4th percentile
Published
2019-10-21T19:10Z
EPSS history
Timeline
  • 21 OCT 19:10Z
    An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3
    cvelistv5