Security readout for executives and security teams
Plain-English summary
FusionPBX 4.4.1 has an XSS flaw in the web interface where a redirect parameter can cause attacker-supplied script or HTML to run in a user's browser. Business impact depends on who can reach that page and whose browser is affected, but admin web access makes this worth prioritizing.
Executive priority
Prioritize remediation if FusionPBX manages business telephony or is reachable from the internet. Without confirmed active exploitation or CVSS, this is not automatically critical, but XSS in an administrative application can become serious when privileged users are targeted.
Technical view
The CVE describes cross-site scripting in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 via the redirect parameter. The source bundle names an upstream commit reference, but provides no CVSS, CWE, authentication context, or fixed release number. Treat the issue as web-control-plane input handling requiring vendor-confirmed remediation.
Likely exposure
Likely exposure is FusionPBX 4.4.1 instances with the affected xml_cdr_search.php route reachable to users or attackers. Exposure is higher when the FusionPBX web interface is internet-accessible or used by privileged administrators. The bundle does not confirm other versions or products.
Exploitation context
The bundle includes a public report and upstream commit reference, but does not show CISA KEV listing or confirm active exploitation. XSS could enable browser-side actions in a victim's session, especially against privileged users, but exact exploitability conditions are not fully documented here.
Researcher notes
Key unknowns are authentication requirements, affected version range, fixed release mapping, and whether the issue is reflected or otherwise persistent. Base validation on the named file, redirect parameter, FusionPBX 4.4.1, and commit f3047c83f3022a4780dca95ed7bccbf3a6fa868e.
Mitigation direction
- Inventory FusionPBX deployments and identify any running version 4.4.1.
- Review vendor guidance and upgrade to a release containing the referenced fix.
- If patch timing is unclear, restrict FusionPBX web access to trusted networks or VPN.
- Limit administrative web sessions to hardened workstations and least-privileged accounts.
- Monitor FusionPBX web access logs for unusual requests to xml_cdr_search.php.
Validation and detection
- Confirm whether app/xml_cdr/xml_cdr_search.php exists in deployed FusionPBX instances.
- Verify whether the referenced upstream commit is present in the deployed codebase.
- Check asset inventory for internet-exposed FusionPBX administration interfaces.
- Use safe authenticated testing in staging to confirm redirect input is encoded or rejected.
- Review web logs for historical access to the affected route and redirect parameter.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19366 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://gist.github.com/xax007/94183b11bdfe579fd860a37e74cd3a8eCVE reference · x_refsource_MISC
- https://github.com/fusionpbx/fusionpbx/commit/f3047c83f3022a4780dca95ed7bccbf3a6fa868eCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.