CVE-2024-47071CWE-22

OSS Endpoint Manager allows unauthorized access to read system files

Medium · published October 1, 2024

CVSS v3.1
6.8
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00509 · 42.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-10-01T15:40Z
EPSS history
Timeline
  • 01 OCT 15:40Z
    OSS Endpoint Manager allows unauthorized access to read system files
    cvelistv5