A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3) newfilename variables in app\edit\filerename.php.
References
| Link | Resource |
|---|---|
| https://github.com/fusionpbx/fusionpbx/commit/1a88ca61a744914d3336cc15a40fb3edbcde9085 | Patch Third Party Advisory |
| https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-path-traversal-6/ | Third Party Advisory |
Configurations
History
25 May 2021, 20:02
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| References | (MISC) https://github.com/fusionpbx/fusionpbx/commit/1a88ca61a744914d3336cc15a40fb3edbcde9085 - Patch, Third Party Advisory | |
| References | (MISC) https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-path-traversal-6/ - Third Party Advisory | |
| CPE | cpe:2.3:a:fusionpbx:fusionpbx:4.5.7:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
20 May 2021, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-05-20 16:15
Updated : 2024-02-04 21:47
NVD link : CVE-2020-21055
Mitre link : CVE-2020-21055
CVE.ORG link : CVE-2020-21055
JSON object : View
Products Affected
fusionpbx
- fusionpbx
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')