Description (CNA)
A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Sangoma / FreePBX | affected 17.0.19.17 |
CWE
CWE-434
References
- https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903
- https://gist.github.com/hyp164D1/d419bdf3e7e352088a21631d0f452a8c
ADP enrichment
No English description supplied.
No references supplied.