PT-2022-12370 · 3Cx · 3Cx System

Published 2022-03-21 · Updated 2022-03-31 · CVE-2021-45491

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 3CX System through 2022-03-17

Description The issue concerns the storage of cleartext passwords in a database. This means that passwords are stored in a readable format, potentially allowing unauthorized access to sensitive information.

Recommendations For 3CX System through 2022-03-17, consider updating to a version released after 2022-03-17 to ensure passwords are stored securely. As a temporary workaround, restrict access to the database to minimize the risk of exploitation. Avoid using the password variable in any database queries until the issue is resolved.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-45491

Affected Products

3Cx System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-45491 · Security Note
• https://3cx.com/community/forums/posts-articles-news · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45491 · Vendor Advisory
• https://t.me/cvenotify/28232 · Telegram Post
• http://packetstormsecurity.com/files/166386/3CX-Phone-System-Cleartext-Passwords.html · Note
• https://t.me/defcon_news/98214 · Telegram Post
• https://t.me/cibsecurity/39619 · Telegram Post