Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

[penguinpbx (C. Maj)]

@billsimon

Maybe it would be better to offer a finer-grained permissions set for admins. Super-admins can set fields that specify system commands. Normal admins can do everything else an admin can do except manipulate those fields.

Hero mode here we come!

On deck for v18 is migration to User Manager completion, so this fits with that goal, exact nomenclature TBD.

@BlazeStudios

buried in the story is the 0.7 score which represents the actual real world impact of the issue

Agreed and some of the rationale is discussed in Watch what we do with security fixes