CVE-2020-7351CWE-78

Fonality Trixbox CE Post-Authentication Command Injection

High · published May 1, 2020

Patch now

High probability of exploitation

CVSS calls it high at 7.3. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1

7.3

EPSS

65%

Percentile

99.3

In the wild

Unconfirmed

What it is

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.

The record

Technical detail

CVSS v3.1: 7.3 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.65208 · 99.3th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2020-05-01T15:50Z

EPSS history

Timeline

01 MAY 15:50Z
Fonality Trixbox CE Post-Authentication Command Injection
cvelistv5