CVE-2019-16985

In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows…

published October 21, 2019

CVSS
—
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file of the system.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01140 · 66.3th percentile
Published
2019-10-21T15:27Z
EPSS history
Timeline
  • 21 OCT 15:27Z
    In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows…
    cvelistv5