CVE-2019-19387

Name of the Vulnerable Software and Affected Versions FusionPBX version 4.4.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the c parameter in the /app/fifo list/fifo interactive.php API endpoint.

Recommendations For FusionPBX version 4.4.1, consider disabling the c parameter in the /app/fifo list/fifo interactive.php endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.