Security readout for executives and security teams
Plain-English summary
FusionPBX 4.4.1 has a cross-site scripting flaw in the voicemail greeting edit page. An attacker could inject script or HTML through voicemail-related parameters, potentially affecting users who view the vulnerable page. The public bundle does not provide CVSS, authentication requirements, or confirmed exploitation.
Executive priority
Treat this as a targeted web application risk, not a confirmed emergency. Prioritize remediation for internet-facing or broadly accessible FusionPBX 4.4.1 systems, especially where administrators use the voicemail greeting interface.
Technical view
CVE-2019-19386 affects app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1. The id and/or voicemail_id parameters are reported as XSS injection points. The source bundle links an upstream FusionPBX commit, but does not identify a fixed release or detailed remediation instructions.
Likely exposure
Exposure is most likely where FusionPBX 4.4.1 is deployed and the voicemail greeting edit functionality is reachable by users or administrators. The bundle does not specify whether exploitation requires authentication or user interaction.
Exploitation context
The CVE states remote attackers can inject arbitrary web script or HTML via id and/or voicemail_id. There is no KEV listing and no cited source in the bundle confirming active exploitation.
Researcher notes
Evidence is limited to the CVE description, a public gist reference, and an upstream commit link. Missing details include CVSS, CWE, authentication context, stored versus reflected behavior, fixed version, and exploitation in the wild.
Mitigation direction
- Identify any FusionPBX 4.4.1 deployments.
- Review the linked FusionPBX commit and vendor guidance.
- Upgrade or patch according to confirmed FusionPBX guidance.
- Restrict access to FusionPBX administrative surfaces where possible.
- Monitor for unusual requests to voicemail_greeting_edit.php.
Validation and detection
- Inventory FusionPBX versions across production and staging.
- Confirm whether voicemail_greeting_edit.php is reachable.
- Review web logs for id or voicemail_id abuse patterns.
- Verify remediation against vendor guidance after patching.
- Check that access controls limit administrative page exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19386 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://gist.github.com/xax007/28e7326acfae677be0b351216888e522CVE reference · x_refsource_MISC
- https://github.com/fusionpbx/fusionpbx/commit/9e837fadecdd5199819a949b5b1bd84b19f716f2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.