CVE-2019-16966

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2019-16966

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16966.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-16966

Published

2019-10-21T19:15:11Z

Modified

2026-07-08T20:04:07Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.

References

Affected packages

Git / github.com/freepbx/contactmanager

Affected ranges

Type

GIT

Repo

https://github.com/freepbx/contactmanager

Events

Introduced

8ca1e8389905bae2937e476fd3150aba5e0734f3

Fixed

407c80a93c8bcd05762fc66ff93f2c8f3b7f40a7

Introduced

b11cb56547db9b8f8b814230a46e0efea3ae718f

Fixed

4bf4cdb67fd31a7cab641c73b002a6ca06085c08

Introduced

8d26ffdc1b43b60a895d741db56336cce63d67b7

Fixed

64f46c6f6ca5f3e8b2f673343d1851cc178453d6

Introduced

30355d0c3753848e715e4a949a8b35b61d194943

Last Affected

3636f7893013e61831c829b3bdbd75e362cb15b0

Fixed

99e5aa0050224289cfe64c9036f38ce2531bf633

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:freepbx:contactmanager:*:*:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta1:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta2:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta3:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta4:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta5:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:14.0.1:-:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:14.0.1:alpha1:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:14.0.1:alpha2:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:14.0.1:beta1:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:14.0.1:beta2:*:*:*:freepbx:*:*",
        "cpe:2.3:a:freepbx:contactmanager:14.0.1:beta3:*:*:*:freepbx:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "13.0.2"
        },
        {
            "fixed": "13.0.45.3"
        },
        {
            "introduced": "14.0.1.1"
        },
        {
            "fixed": "14.0.5.12"
        },
        {
            "introduced": "15.0.2"
        },
        {
            "fixed": "15.0.8.21"
        },
        {
            "introduced": "13.0.0-beta1"
        },
        {
            "last_affected": "13.0.0-beta1"
        },
        {
            "introduced": "13.0.0-beta2"
        },
        {
            "last_affected": "13.0.0-beta2"
        },
        {
            "introduced": "13.0.0-beta3"
        },
        {
            "last_affected": "13.0.0-beta3"
        },
        {
            "introduced": "13.0.0-beta4"
        },
        {
            "last_affected": "13.0.0-beta4"
        },
        {
            "introduced": "13.0.0-beta5"
        },
        {
            "last_affected": "13.0.0-beta5"
        },
        {
            "introduced": "14.0.1-NA"
        },
        {
            "last_affected": "14.0.1-NA"
        },
        {
            "introduced": "14.0.1-alpha1"
        },
        {
            "last_affected": "14.0.1-alpha1"
        },
        {
            "introduced": "14.0.1-alpha2"
        },
        {
            "last_affected": "14.0.1-alpha2"
        },
        {
            "introduced": "14.0.1-beta1"
        },
        {
            "last_affected": "14.0.1-beta1"
        },
        {
            "introduced": "14.0.1-beta2"
        },
        {
            "last_affected": "14.0.1-beta2"
        },
        {
            "introduced": "14.0.1-beta3"
        },
        {
            "last_affected": "14.0.1-beta3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

13.*

13.0.0-beta1

13.0.0-beta2

13.0.0-beta3

13.0.0-beta4

13.0.0-beta5

14.*

14.0.1-NA

14.0.1-alpha1

14.0.1-alpha2

14.0.1-beta1

14.0.1-beta2

14.0.1-beta3

release/13.*

release/13.0.10

release/13.0.11

release/13.0.12

release/13.0.13

release/13.0.14

release/13.0.15

release/13.0.16

release/13.0.17

release/13.0.2

release/13.0.20

release/13.0.21

release/13.0.22

release/13.0.23

release/13.0.24

release/13.0.25

release/13.0.26

release/13.0.27

release/13.0.28

release/13.0.29

release/13.0.3

release/13.0.30

release/13.0.31

release/13.0.32

release/13.0.33

release/13.0.34

release/13.0.35

release/13.0.36

release/13.0.37

release/13.0.38

release/13.0.4

release/13.0.40

release/13.0.41

release/13.0.41.10

release/13.0.41.11

release/13.0.41.12

release/13.0.41.13

release/13.0.41.14

release/13.0.41.3

release/13.0.41.4

release/13.0.41.5

release/13.0.41.6

release/13.0.41.7

release/13.0.41.8

release/13.0.42

release/13.0.42.1

release/13.0.42.10

release/13.0.42.11

release/13.0.42.12

release/13.0.42.13

release/13.0.42.2

release/13.0.42.3

release/13.0.42.4

release/13.0.42.5

release/13.0.42.7

release/13.0.42.8

release/13.0.42.9

release/13.0.43

release/13.0.43.1

release/13.0.43.10

release/13.0.43.11

release/13.0.43.12

release/13.0.43.13

release/13.0.43.2

release/13.0.43.3

release/13.0.43.4

release/13.0.43.5

release/13.0.43.6

release/13.0.43.7

release/13.0.43.8

release/13.0.43.9

release/13.0.44

release/13.0.45

release/13.0.5

release/13.0.6

release/13.0.8

release/13.0.9

release/14.*

release/14.0.1alpha1

release/14.0.1alpha2

release/14.0.1beta1

release/14.0.1beta2

release/14.0.1beta3

release/14.0.4.10

release/14.0.4.11

release/14.0.4.12

release/14.0.4.13

release/14.0.4.9

release/14.0.5

release/14.0.5.1

release/14.0.5.10

release/14.0.5.11

release/14.0.5.2

release/14.0.5.3

release/14.0.5.4

release/14.0.5.5

release/14.0.5.6

release/14.0.5.7

release/14.0.5.8

release/14.0.5.9

release/15.*

release/15.0.2

release/15.0.3

release/15.0.4

release/15.0.5

release/15.0.6

release/15.0.7

release/15.0.8

release/15.0.8.1

release/15.0.8.10

release/15.0.8.11

release/15.0.8.12

release/15.0.8.13

release/15.0.8.14

release/15.0.8.15

release/15.0.8.16

release/15.0.8.17

release/15.0.8.18

release/15.0.8.19

release/15.0.8.2

release/15.0.8.20

release/15.0.8.3

release/15.0.8.4

release/15.0.8.5

release/15.0.8.6

release/15.0.8.7

release/15.0.8.8

release/15.0.8.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16966.json"

Git / github.com/freepbx/framework

Affected ranges

Type

GIT

Repo

https://github.com/freepbx/framework

Events

Introduced

fef337a31ecbe7ab2559348030f608dbde66d856

Last Affected

fef337a31ecbe7ab2559348030f608dbde66d856

Database specific

Show details

{
    "cpe": "cpe:2.3:a:sangoma:freepbx:14.0.10.3:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "14.0.10.3"
        },
        {
            "last_affected": "14.0.10.3"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

14.*

14.0.10.3

release/14.*

release/14.0.10.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16966.json"