CVE Vulnerability

CVE-2019-11409

app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.

6.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611 Patch Third Party Advisory
https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html Exploit Third Party Advisory
http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.html Exploit Third Party Advisory
http://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.html Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:fusionpbx:fusionpbx:4.4.3:*:*:*:*:*:*:*
Information

Published : 2019-06-17 07:15

Updated : 2022-04-18 05:16

NVD link : CVE-2019-11409

Mitre link : CVE-2019-11409

Products Affected
No products.
CWE
CWE-78