CVE-2019-11407 Information disclosure in n/a

High 7.2 Published 17 Jun 2019 Updated 4 Aug 2024

Authenticated administrators can access excessive debug information in the Operator Panel, potentially exposing credentials and sensitive data.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-11407?

CVE-2019-11407 is a high-severity vulnerability in Fusionpbx Fusionpbx, published on 17 Jun 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information.

Weakness: CWE-200

Which versions are affected by CVE-2019-11407?

It affects 1 product.

Products include Fusionpbx Fusionpbx.

How do I fix CVE-2019-11407?

No fix has been published for CVE-2019-11407 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-11407 being exploited?

There is no known exploitation of CVE-2019-11407 in the wild and no public exploit code.

All Fusionpbx Fusionpbx vulnerabilities

Sources

Also known as GHSA-3mwm-gvjc-9x56.