CVE-2018-15891

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-20 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.

Affected products

Freepbx: 15.0.1
Sangoma FreePBX: before 13.0.122.43; from 14.0.0 before 14.0.18.34; from 15.0.0 through 15.0.1; 15.0.1-beta4 — fixed in 13.0.122.43, 14.0.18.34

How to fix

Upgrade to a fixed version: Sangoma FreePBX 13.0.122.43, 14.0.18.34. Check the vendor advisory for mitigations.

References

https://wiki.freepbx.org/display/FOP/2018-09-11+Core+Stored+XSS?src=contextnavpagetreemode
https://www.freepbx.org/
https://wiki.freepbx.org/display/FOP/2018-09-11+Core+Stored+XSS?src=contextnavpagetreemode
https://www.freepbx.org/

Get alerted when CVE-2018-15891 or the next vulnerability affects your stack