Security readout for executives and security teams
Plain-English summary
This is a stored cross-site scripting issue in Sangoma FreePBX User Management. A user with access to the User Control Panel could save malicious content in time/date or time-zone fields. If an administrator later views that profile, code may run in the administrator's browser session.
Executive priority
Prioritize as a contained but meaningful administrative-session risk. It is not described as remotely exploitable without access, but compromise of an administrator browser session could affect PBX management depending on privileges and exposure.
Technical view
CVE-2019-19551 affects the FreePBX userman module versions 13.0.76.43 through 15.0.20. The issue is improper sanitization of user-controlled time/date formatting and time-zone fields, leading to stored XSS in the Administrator User Management screen when a victim views the affected profile.
Likely exposure
Exposure is most likely where FreePBX uses the affected userman versions and untrusted or lower-privileged users can access the User Control Panel. Internet-exposed UCP or administrator interfaces increase urgency.
Exploitation context
The bundle does not show CISA KEV listing, active exploitation, public exploit confirmation, or CVSS scoring. Exploitation requires UCP access and a victim, such as an administrator, viewing the affected user profile.
Researcher notes
The source data names FreePBX userman and describes stored XSS through specific profile fields. It does not provide CVSS, CWE, exploit status, or a specific fixed release in the supplied bundle, so remediation should be tied to vendor guidance.
Mitigation direction
- Check Sangoma FreePBX guidance for fixed userman versions or vendor-recommended remediation.
- Restrict UCP access to trusted users and networks where possible.
- Limit administrator interface access to trusted networks and authenticated administrators.
- Review user profile time/date and time-zone fields for unexpected content.
- Remove suspicious field values and investigate the associated account activity.
Validation and detection
- Inventory FreePBX systems and installed userman module versions.
- Flag userman versions 13.0.76.43 through 15.0.20 as potentially affected.
- Confirm whether UCP is reachable by untrusted users or from the internet.
- Review administrator activity around User Management profile views.
- Check logs or audit records for unusual profile field changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19551 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wiki.freepbx.org/display/FOP/2019-12-03+Multiple+XSS+VulnerabilitiesCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.