CVE-2018-7654

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path…

published March 4, 2018

CVSS
—
EPSS
2%
Percentile
83.7
In the wild
Unconfirmed
What it is

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02378 · 83.7th percentile
Published
2018-03-04T01:00Z
EPSS history
Timeline
  • 04 MAR 01:00Z
    On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path…
    cvelistv5