CVE-2019-16986

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download…

published October 21, 2019

CVSS
—
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01405 · 72.4th percentile
Published
2019-10-21T15:38Z
EPSS history
Timeline
  • 21 OCT 15:38Z
    In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download…
    cvelistv5