CVE-2019-25090: XSS in FreePBX ariManager

Successful exploitation of CVE-2019-25090 allows an attacker to inject arbitrary JavaScript code into the FreePBX ariManager interface. This can be leveraged to steal user session cookies, allowing the attacker to impersonate legitimate users. The attacker could also modify the content displayed to users, potentially leading to phishing attacks or defacement of the ariManager interface. Given ariManager’s role in managing FreePBX features, a compromised instance could provide an attacker with a foothold into the broader telephony system.

1. Reserved2022-12-27
2. Published2022-12-27
3. Modified2024-08-05
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-25090 is to upgrade FreePBX ariManager to version 13.0.5.4 or later, which includes the fix (patch identifier: 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab). If an immediate upgrade is not feasible, consider implementing input validation and sanitization on the dataurl parameter to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via the dataurl parameter and verifying that it is properly sanitized.