{"id":"CVE-2019-16967","details":"An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\\admin\\modules\\manager\\views\\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager.","modified":"2026-02-21T00:58:35.936497Z","published":"2019-10-21T20:15:10.883Z","references":[{"type":"ADVISORY","url":"https://github.com/FreePBX/manager/commit/071a50983ca6a373bb2d1d3db68e9eda4667a372"},{"type":"ADVISORY","url":"https://issues.freepbx.org/browse/FREEPBX-20436"},{"type":"ADVISORY","url":"https://resp3ctblog.wordpress.com/2019/10/19/freepbx-xss-2/"},{"type":"FIX","url":"https://github.com/FreePBX/manager/commit/071a50983ca6a373bb2d1d3db68e9eda4667a372"},{"type":"FIX","url":"https://resp3ctblog.wordpress.com/2019/10/19/freepbx-xss-2/"},{"type":"EVIDENCE","url":"https://issues.freepbx.org/browse/FREEPBX-20436"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freepbx/core","events":[{"introduced":"e8d16832dede1ccdbbebf31cc39772e30bfa462d"},{"fixed":"8972934be22d583b2cc2dc3a052098acb91e55ea"}]}],"versions":["release/13.0.122.47","release/13.0.122.48","release/13.0.122.49","release/13.0.122.50","release/13.0.122.51","release/13.0.122.52","release/13.0.122.53","release/13.0.122.54","release/13.0.122.55","release/13.0.122.56","release/13.0.122.57","release/13.0.122.58","release/13.0.122.59","release/13.0.122.60","release/13.0.123","release/14.0.18.39","release/14.0.18.40","release/14.0.18.41","release/14.0.18.42","release/14.0.18.43","release/14.0.18.44","release/14.0.18.45","release/14.0.18.46","release/14.0.18.47","release/14.0.18.48","release/14.0.18.49","release/14.0.18.50","release/14.0.18.51","release/14.0.18.52","release/14.0.18.53","release/14.0.18.54","release/14.0.19","release/15.0.2","release/15.0.3","release/15.0.3.1","release/15.0.3.10","release/15.0.3.11","release/15.0.3.12","release/15.0.3.13","release/15.0.3.14","release/15.0.3.15","release/15.0.3.16","release/15.0.3.17","release/15.0.3.18","release/15.0.3.19","release/15.0.3.2","release/15.0.3.20","release/15.0.3.21","release/15.0.3.22","release/15.0.3.23","release/15.0.3.24","release/15.0.3.25","release/15.0.3.26","release/15.0.3.27","release/15.0.3.3","release/15.0.3.4","release/15.0.3.5","release/15.0.3.6","release/15.0.3.7","release/15.0.3.8","release/15.0.3.9","release/15.0.4","release/15.0.5"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16967.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/freepbx/framework","events":[{"introduced":"2a7dc3139b27d354ecbebd59e6911a5c9df2d9d8"},{"fixed":"ecf7d58676c51cea8e2492256722343346ada20b"}]}],"versions":["release/13.0.195.25","release/13.0.195.26","release/13.0.195.27","release/13.0.195.28","release/13.0.196","release/14.0.5.13","release/14.0.5.14","release/14.0.5.15","release/14.0.5.16","release/14.0.5.17","release/14.0.5.18","release/14.0.5.19","release/14.0.5.20","release/14.0.5.21","release/14.0.5.22","release/14.0.5.23","release/14.0.5.24","release/14.0.5.25","release/14.0.5.26","release/14.0.5.27","release/14.0.5.28","release/14.0.6","release/14.0.7","release/14.0.7.1","release/14.0.7.2","release/14.0.7.3","release/15.0.2","release/15.0.2.1","release/15.0.2.10","release/15.0.2.11","release/15.0.2.12","release/15.0.2.13","release/15.0.2.14","release/15.0.2.15","release/15.0.2.16","release/15.0.2.2","release/15.0.2.3","release/15.0.2.4","release/15.0.2.5","release/15.0.2.6","release/15.0.2.7","release/15.0.2.8","release/15.0.2.9","release/15.0.3","release/15.0.4","release/15.0.5","release/15.0.5.1","release/15.0.5.11","release/15.0.5.12","release/15.0.5.13","release/15.0.5.14","release/15.0.5.2","release/15.0.5.3","release/15.0.5.5","release/15.0.5.6","release/15.0.5.7","release/15.0.5.8","release/15.0.5.9"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16967.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/freepbx/manager","events":[{"introduced":"0"},{"fixed":"071a50983ca6a373bb2d1d3db68e9eda4667a372"},{"introduced":"1115ce90a0cbfe286581db371eb64c64e9125726"},{"fixed":"a0022efa1baf3d54741e24948b6bd1b681b9fdfa"},{"introduced":"610c97d7cc5feedb93f382fcad4a25b5e9ee26e1"},{"fixed":"d4377cb86558cf3bc82aedeadb69375d21cb6bab"}]}],"versions":["release/13.0.2","release/13.0.2.1","release/13.0.2.2","release/13.0.2.3","release/13.0.2.4","release/13.0.2.5"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16967.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}