PT-2024-32389 · Unknown · Oss Endpoint Manager

Vsc55 · Published 2024-10-01 · Updated 2024-10-04 · CVE-2024-47071

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OSS Endpoint Manager versions prior to 14.0.4

Description The OSS Endpoint Manager module for FreePBX has an issue where its activation can allow authenticated web users to read system files without permission, using the permissions of the webserver process.

Recommendations For versions prior to 14.0.4, update to version 14.0.4 to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-47071

GHSA-X9WC-QJRC-J7WW

Affected Products

Oss Endpoint Manager

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47071.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47071 · Security Note
• https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719 · Note
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww · Note
• https://t.me/cvedetector/6779 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1841225339600564679 · Twitter Post
• https://twitter.com/CVEnew/status/1841143891635945548 · Twitter Post