CVE-2019-11409

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2019-11409

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11409.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-11409

Published

2019-06-17T19:15:11Z

Modified

2026-07-08T05:52:59Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:fusionpbx:fusionpbx:4.4.3:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "4.4.3"
                },
                {
                    "last_affected": "4.4.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "fusionpbx:fusionpbx"
        }
    ]
}

References

Affected packages

Git / github.com/fusionpbx/fusionpbx

Affected ranges

Type

GIT

Repo

https://github.com/fusionpbx/fusionpbx

Events

Introduced

Fixed

e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11409.json"