CVSS: 4.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-15891
https://notcve.org/view.php?id=CVE-2018-15891
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name. Se detecto un problema en el núcleo de FreePBX antes de la versión 3.0.122.43, 14.0.18.34 y 5.0.1beta4. Al crear una solicitud para agregar módulos de Asterisk, un atacante puede almacenar comandos de JavaScript en el nombre de un módulo. • https://wiki.freepbx.org/display/FOP/2018-09-11+Core+Stored+XSS?src=contextnavpagetreemode https://www.freepbx.org • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 89%CPEs: 22EXPL: 1CVE-2014-7235 – Freepbx < 2.11.1.5 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-7235
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014. En el archivo htdocs_ari/includes/login.php en el módulo del Framework ARI/Asterisk Recording Interface (ARI) en FreePBX anterior a versión 2.9.0.9, versiones 2.10.x y versiones 2.11 anteriores a 2.11.1.5, permite a los atacantes remotos ejecutar código arbitrario por medio de la cookie ari_auth, relacionada con la función unserialize de PHP, como se explotó “in the wild” en septiembre de 2014. FreePBX versions prior to 2.11.1.5 suffer from a code execution vulnerability. • https://www.exploit-db.com/exploits/41005 http://community.freepbx.org/t/critical-freepbx-rce-vulnerability-all-versions-cve-2014-7235/24536 http://packetstormsecurity.com/files/128516/FreePBX-Authentication-Bypass-Account-Creation.html http://secunia.com/advisories/61601 http://www.securityfocus.com/bid/70188 https://exchange.xforce.ibmcloud.com/vulnerabilities/96790 https://github.com/FreePBX/fw_ari/commit/f294b4580ce725ca3c5e692d86e63d40cef4d836 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 36%CPEs: 2EXPL: 7CVE-2012-4869 – FreePBX 2.9.0/2.10.0 - 'callmenum' Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-4869
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. La función callme_startcall en recordings/misc/callme_page.php en FreePBX v2.9, v2.10 y anteriores permite a atacantes remotos ejecutar comandos arbitrarios a través del parámetro callmenum en acción alterna. • https://www.exploit-db.com/exploits/18659 https://www.exploit-db.com/exploits/18649 https://www.exploit-db.com/exploits/18650 https://github.com/0xConstant/CVE-2012-4869 http://packetstormsecurity.org/files/111028/FreePBX-2.10.0-Remote-Command-Execution-XSS.html http://seclists.org/fulldisclosure/2012/Mar/234 http://secunia.com/advisories/48463 http://www.exploit-db.com/exploits/18649 http://www.exploit-db.com/exploits/18659 http://www.freepbx.org/trac/ticket/5711 http • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 5CVE-2012-4870 – FreePBX 2.9.0/2.10.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-4870
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to panel/flash/mypage.php; (5) PATH_INFO to admin/views/freepbx_reload.php; or (6) login parameter to recordings/index.php. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en FreePBX v2.9 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro de contexto (1) al panel/index_amp.php o (2) Panel/dhtml/index.php, (3) CLID o (4) parámetros clidname al panel/flash/mypage.php, (5) PATH_INFO para admin/views/freepbx_reload.php, o (6) parámetro login/index.php a las grabaciones. • https://www.exploit-db.com/exploits/18649 http://packetstormsecurity.org/files/111028/FreePBX-2.10.0-Remote-Command-Execution-XSS.html http://seclists.org/fulldisclosure/2012/Mar/234 http://secunia.com/advisories/48463 http://secunia.com/advisories/48475 http://www.exploit-db.com/exploits/18649 http://www.freepbx.org/trac/ticket/5711 http://www.securityfocus.com/bid/52630 https://exchange.xforce.ibmcloud.com/vulnerabilities/74173 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 86%CPEs: 1EXPL: 3CVE-2010-3490 – FreePBX 2.8.0 - Recordings Interface Allows Remote Code Execution
https://notcve.org/view.php?id=CVE-2010-3490
Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. (dot dot) in the usersnum parameter to admin/config.php, as demonstrated by creating a .php file under the web root. Multiples vulnerabilidades de salto de directorio en page.recordings.php en el componente System Recordings en la interface de cofiguración en interfaz en FreePBX v2.8.0 y anteriores permite a administradores autenticados remotamente crear ficheros a su elección a través de .. (punto punto) en el parámetro usersnum en dmin/config.php, como quedó demostrado en la creacción de un fichero .php bajo la raíz web. FreePBX versions 2.8.0 and below suffer from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/15098 https://github.com/moayadalmalat/CVE-2010-3490 http://www.exploit-db.com/exploits/15098 http://www.freepbx.org/trac/ticket/4553 http://www.securityfocus.com/archive/1/513947/100/0/threaded http://www.securityfocus.com/bid/43454 https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •