Lucene search

[email protected]CVE-2019-19538

HistoryMar 16, 2020 - 9:15 p.m.

CVE-2019-19538

2020-03-1621:15:12

[email protected]

web.nvd.nist.gov

sangoma

freepbx

remote command execution

vulnerability

privilege escalation

cve-2019-19538

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

69.4%

JSON

In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation.

Affected configurations

NVD

Node

sangomafreepbxRange<13.0.92

sangomafreepbxRange14.0.0.0–14.0.38.3

sangomafreepbxRange15.0.0.0–15.0.13.6

CPENameOperatorVersion
sangoma:freepbxsangoma freepbxlt13.0.92
sangoma:freepbxsangoma freepbxlt14.0.38.3
sangoma:freepbxsangoma freepbxlt15.0.13.6

CPE	Name	Operator	Version
sangoma:freepbx	sangoma freepbx	lt	13.0.92
sangoma:freepbx	sangoma freepbx	lt	14.0.38.3
sangoma:freepbx	sangoma freepbx	lt	15.0.13.6

References

community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-00

wiki.freepbx.org/display/FOP/2019-12-03+Remote+Command+Execution

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

69.4%

JSON

Related for CVE-2019-19538

nvd1 cvelist1 prion1 osv1