CVE-2019-11408

Published: 2019-06-17T18:15Z

Last Modified: 2024-11-21T04:21Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number. This can further lead to remote code execution by chaining this vulnerability with a command injection vulnerability also present in FusionPBX. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt