PT-2019-14885 · Fusionpbx · Fusionpbx

Pierre Jourdan · CVE-2019-16965 · Publicado 2019-10-21 · Atualizado 2023-02-04

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FusionPBX versions up to 4.5.7

Description The issue is related to a command injection vulnerability due to a lack of input validation in the resources/cmd.php file. This allows authenticated administrative attackers to execute any commands on the host as www-data.

Recommendations For FusionPBX versions up to 4.5.7, update to a version that includes input validation for the resources/cmd.php file to prevent command injection attacks. As a temporary workaround, consider restricting access to the resources/cmd.php file to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-16965

Produtos afetados

Fusionpbx

Referências · 5

• https://github.com/fusionpbx/fusionpbx/commit/6baad9af1bc55c80b793af3bd1ac35b39c20b173 · Nota
• https://t.me/cvenotify/43610 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-16965 · Nota de Segurança
• https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sofia-api-command-injection-2 · Nota
• https://osv.dev/vulnerability/CVE-2019-16965 · Aviso do Fabricante