PT-2019-14884 · Fusionpbx · Fusionpbx

Pierre Jourdan · Publicado 2019-10-21 · Atualizado 2020-08-24 · CVE-2019-16964

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FusionPBX versions up to 4.5.7

Description The issue arises from a lack of input validation in the Call Center Queue Module, specifically in the app/call centers/cmd.php file. This allows authenticated attackers with certain permissions to execute commands on the host. The permissions required for exploitation are call center queue add or call center queue edit.

Recommendations For FusionPBX versions up to 4.5.7, update to a version that includes a fix for this issue to prevent command injection attacks. As a temporary workaround, consider restricting access to the Call Center Queue Module for users with the call center queue add or call center queue edit permissions until a patch is available.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-16964

Produtos afetados

Fusionpbx

Referências · 4

• https://github.com/fusionpbx/fusionpbx/commit/2f9e591a4034c3aea70185dcab837946096449bf · Correção
• https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sofia-api-command-injection-1 · Nota
• https://osv.dev/vulnerability/CVE-2019-16964 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16964 · Nota de Segurança