CVE-2018-19911

https://notcve.org/view.php?id=CVE-2018-19911

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used. FreeSWITCH hasta la versión 1.8.2, cuando mod_xml_rpc está habilitado, permite que atacantes remotos ejecuten comandos arbitrarios mediante las cadenas de consulta api/system o txtapi/system (o api/bg_system o txtapi/bg_system) en el puerto TCP 8080, tal y como queda demostrado por un URI api/system? • https://github.com/iSafeBlue/freeswitch_rce/blob/master/README-en.md https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.py • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-352: Cross-Site Request Forgery (CSRF) •