PT-2019-12292 · Fusionpbx · Fusionpbx

Dustin Cobb · Publicado 2019-06-17 · Atualizado 2019-06-18 · CVE-2019-11407

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FusionPBX version 4.4.3

Description The issue is related to excessive debug information in the Operator Panel module, specifically in the app/operator panel/index inc.php file. This allows authenticated administrative attackers to obtain credentials and other sensitive information.

Recommendations For FusionPBX version 4.4.3, consider disabling the debug information in the Operator Panel module as a temporary workaround until a patch is available. Restrict access to the Operator Panel module to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-11407

Produtos afetados

Fusionpbx

Referências · 4

• https://github.com/fusionpbx/fusionpbx/commit/f38676b7b63bb1ec3a68d577fe23e6701f482aef · Correção
• https://osv.dev/vulnerability/CVE-2019-11407 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11407 · Nota de Segurança
• https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html · Nota