Security readout for executives and security teams
Plain-English summary
FusionPBX 4.4.1 has a reported cross-site scripting issue in a fax file page. An attacker could inject script or HTML through the id parameter, potentially affecting users who view the crafted page. The public record does not provide CVSS scoring or confirmed active exploitation.
Executive priority
Treat this as a targeted remediation item rather than an emergency unless FusionPBX is internet-facing or used by many privileged users. Prioritize inventory, patch confirmation, and access restriction because XSS can support account compromise or administrative session abuse.
Technical view
CVE-2019-19367 describes XSS in app/fax/fax_files.php in FusionPBX 4.4.1 via the id parameter. The source bundle lists an upstream GitHub commit reference, but does not state a fixed release version, exploit prevalence, authentication requirements, or detailed impact boundaries.
Likely exposure
Exposure is most likely in organizations running FusionPBX 4.4.1, especially where the FusionPBX web interface or fax functions are reachable by untrusted users. The bundle does not confirm other affected versions or deployment prerequisites.
Exploitation context
The CVE is not listed as CISA KEV in the provided bundle. Public references include a gist and an upstream commit, but the bundle does not prove active exploitation or provide reliable prevalence data.
Researcher notes
The evidence is thin: no CVSS, CWE, fixed version, authentication context, or exploit status is supplied. The affected product is named in the description despite the structured affected field being n/a. Validate directly against FusionPBX 4.4.1 and the referenced commit before broad conclusions.
Mitigation direction
- Identify FusionPBX instances and confirm whether version 4.4.1 is present.
- Review FusionPBX vendor guidance and the referenced upstream commit for remediation direction.
- Update to a vendor-supported fixed release when confirmed by FusionPBX guidance.
- Restrict FusionPBX administration and fax pages to trusted networks and authenticated users.
- Monitor access to fax_files.php for unusual requests involving the id parameter.
Validation and detection
- Inventory FusionPBX versions across internet-facing and internal systems.
- Confirm whether app/fax/fax_files.php includes the referenced upstream fix.
- Have an authorized tester verify the id parameter is safely handled in a controlled environment.
- Review web logs for suspicious access to the affected fax file route.
- Confirm compensating access controls protect the FusionPBX web interface.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://gist.github.com/xax007/94183b11bdfe579fd860a37e74cd3a8eCVE reference · x_refsource_MISC
- https://github.com/fusionpbx/fusionpbx/commit/72a5ce4d2d6bc0ec0e72bbfb76487e4761f292c5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.