CVE Vulnerabilities

CVE-2019-19006

Improper Authentication

Published: Nov 21, 2019 | Modified: Aug 24, 2020
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Freepbx Sangoma 13.0.0.0 (including) 13.0.197.13 (including)
Freepbx Sangoma 14.0.0.0 (including) 14.0.13.11 (including)
Freepbx Sangoma 15.0.0.0 (including) 15.0.16.26 (including)

Potential Mitigations

References