PT-2019-13877 · 3Cx · 3Cx Phone

Conan.Chiles · Publicado 2019-08-11 · Atualizado 2020-08-24 · CVE-2019-14935

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3CX Phone version 15

Description The issue concerns insecure permissions on the installation directory, specifically the "%PROGRAMDATA%3CXPhone for WindowsPhoneApp" directory, which allows Full Control access for Everyone. This insecurity leads to privilege escalation due to a StartUp link.

Recommendations For version 15, consider restricting access to the "%PROGRAMDATA%3CXPhone for WindowsPhoneApp" directory to prevent Full Control access for Everyone, and review StartUp links for potential removal or modification to mitigate the risk of privilege escalation.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2019-14935

Produtos afetados

3Cx Phone

Referências · 3

• 🔥 https://3cx.com/community/threads/security-issue-with-3cx-windows-client-install.64432 · Exploit
• https://osv.dev/vulnerability/CVE-2019-14935 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14935 · Nota de Segurança