PT-2018-12792 · 3Cx · 3Cx

Published 2018-08-03 · Updated 2020-08-24 · CVE-2018-14907

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions 3CX version 15.5.8801.3

Description The issue concerns improper error handling in stack traces, which can lead to information leakage. This is demonstrated by the possibility of discovering a full pathname.

Recommendations For version 15.5.8801.3, consider disabling error handling in stack traces or restricting access to the stack trace information until a patch is available.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2018-14907

Affected Products

3Cx

References · 3

• 🔥 https://medium.com/stolabs/security-issues-on-3cx-web-service-d9dc7f1bea79 · Exploit
• https://osv.dev/vulnerability/CVE-2018-14907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14907 · Security Note