CVE-2019-16949

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This POST request can be modified to change the message as well as the end recipient of the message. The e-mail address will have the same domain name and user as the product allotted. This can be used in phishing campaigns against users on the same domain.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-16956.5A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) SoftwarCVE-2019-169506.1An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion ofCVE-2019-169515.3A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domCVE-2019-169545.4SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.CVE-2019-169555.4SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.CVE-2019-169565.4SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.CVE-2019-169575.4SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.CVE-2019-169585.4Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via LocatCVE-2019-169596.5SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.CVE-2019-16967.4Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) SCVE-2019-169605.4SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.CVE-2019-169615.4SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name.
CVE-2019-16949: Medium severity, CVSS 6.5 | Vulnix