Security Advisory

CVE-2019-16986

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2019-10-21 15:38:00

Last updated 2024-08-05 01:24:48

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)

← Browse all CVEs View on cve.org ↗