CVE-2019-11409
CVE-2019-11409
Vexday Risk Score
60Atención
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
Madurez del exploit
Exploit funcional
Exploit automatizable disponible (Nuclei/Metasploit).
CVSS —EPSS 87.5%KEV nãoPoC públicaNuclei —Metasploit simPatch —
Ciclo de vida
06 jun 2019Exploit Metasploit disponible
17 jun 2019Publicada en NVD
20 nov 2019PoC pública
Velocidad de armamento
155 díashasta el primer PoC
Recomendación: Planificar corrección próxima — ya existe PoC pública.
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
Productos afectados
n/a · n/aPoCs públicas encontradas — 3
cve_referencepacketstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlno verificadocve_referencepacketstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.htmlno verificadoexploitdbwww.exploit-db.com/exploits/47697no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.htmlhttps://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.htmlhttps://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611