CVE-2019-11409 - CVE House
Back to Database
Status published High CVE-2019-11409

app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers...

Vulnerability Description

app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11409

Credits & Attribution

No credits recorded in the NVD database.

References

More from fusionpbx

View All →
CVE-2022-35153
FusionPBX 5.0.1 was discovered to contain a command injection vulnerability...
Critical 9.8
CVE-2022-28055
Fusionpbx v4.4 and below contains a command injection vulnerability via...
Critical 9.8
CVE-2021-43406
An issue was discovered in FusionPBX before 4.5.30. The fax_post_size...
High 8.8
CVE-2021-43405
An issue was discovered in FusionPBX before 4.5.30. The fax_extension...
High 8.8
CVE-2021-43404
An issue was discovered in FusionPBX before 4.5.30. The FAX...
High 8.8

Affected Vendor

Affected Software

fusionpbx
Vulnerable Versions:
4.4.3

Timeline

Official Publish: June 17th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.