medium4.8
CVE-2018-15891
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4.
Impact
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Freepbx | Freepbx | Version 15.0.1 |
| Sangoma | Freepbx | before 13.0.122.43 from 14.0.0 before 14.0.18.34 from 15.0.0 through 15.0.1 Version 15.0.1 |