🟢 Authenticated Second-Order OS Command Execution in FreePBX Recordings via Dialplan Injection

Blog Security
, , , ,
1

Summary

An authenticated ACP admin can execute OS commands via the recordings module.

Authentication with a known username is required.

Common Vulnerabilities and Exposures (CVE)

Requested

GitHub Security Advisory (GHSA)

GHSA-9cjf-xw9x-55hh

Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red)

G - Green

Link to Published GHSA with More Details

Highlights

:green_circle:

2

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.