CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-45490
https://notcve.org/view.php?id=CVE-2021-45490
The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation. Las aplicaciones cliente en 3CX en Windows, la aplicación 3CX para iOS, y la aplicación 3CX para Android versiones hasta 17-03-2022 carecen de comprobación de certificado SSL • https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html https://www.3cx.com/community/forums/posts-articles-news • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2019-13176
https://notcve.org/view.php?id=CVE-2019-13176
An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF (reading local files, outbound HTTP, and outbound DNS). Se detecto un problema en la consola de administración del sistema telefónico 3CX (web) versiones 12.5.44178.1002 a 12.5 SP2. El componente Content.MainForm.wgx se ve afectado por XXE a través de un documento XML diseñado en datos POST. • https://www.logicallysecure.com/blog/3cx-phone-system-web-console-affected-by-xxe • CWE-611: Improper Restriction of XML External Entity Reference •