CVE-2020-7351

Fonality Trixbox CE Post-Authentication Command Injection

CVSS 7.3 HIGHEPSS 65.2%CWE-78

Vexday Risk Score

48Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

CVSS 7.3EPSS 65.2%KEV nãoPoC —Nuclei —Metasploit simPatch —

Ciclo de vida

28 abr 2020Exploit Metasploit disponível

01 mai 2020Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Produtos afetados

Fonality · Trixbox Community Edition

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html https://github.com/rapid7/metasploit-framework/pull/13353