Security readout for executives and security teams
Plain-English summary
FusionPBX 4.4.1 has a reported cross-site scripting flaw in the fax log view. A remote attacker may be able to inject script or HTML through the fax_uuid parameter, potentially affecting users who open the vulnerable page.
Executive priority
Treat this as a moderate web-application risk. Prioritize internet-facing or broadly accessible FusionPBX portals, especially where privileged staff use the fax log interface.
Technical view
CVE-2019-19384 is an XSS issue in app/fax/fax_log_view.php. The CVE description identifies fax_uuid as the injection point. The public bundle references a FusionPBX commit, but does not provide CVSS, authentication details, or a confirmed fixed release number.
Likely exposure
Exposure is most likely where FusionPBX 4.4.1 is deployed and the fax log view is reachable. Risk increases if administrative or fax-management users access the interface through a browser.
Exploitation context
The CVE record says remote attackers can inject script or HTML. The bundle does not show CISA KEV listing, confirmed active exploitation, or clear authentication requirements, so exploitation status and reachability should be validated locally.
Researcher notes
Evidence is limited to the CVE description, a public gist, and a FusionPBX commit reference. No CVSS, CWE, KEV status, affected CPEs, or fixed release version are provided in the bundle.
Mitigation direction
- Upgrade FusionPBX to a version containing the referenced fix or later vendor-supported release.
- Review the referenced FusionPBX commit and apply the vendor patch where upgrading is not immediately possible.
- Restrict access to FusionPBX administrative and fax interfaces to trusted networks or VPN users.
- Confirm browser session protections and least-privilege roles for users who access fax logs.
Validation and detection
- Inventory FusionPBX instances and identify any running version 4.4.1.
- Check whether the referenced commit aea1abaeb12f69dc22967395c528fb2434e316c1 is present.
- Review access logs for requests to app/fax/fax_log_view.php with unusual fax_uuid values.
- In authorized testing, verify fax_uuid output is encoded and not rendered as executable markup.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19384 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://gist.github.com/xax007/28e7326acfae677be0b351216888e522CVE reference · x_refsource_MISC
- https://github.com/fusionpbx/fusionpbx/commit/aea1abaeb12f69dc22967395c528fb2434e316c1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.