Vulnerabilities

TI-2018-10722 CVE-2018-14907 · GHSA-v2rp-vjv7-vgq4

The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because…

LOW 26

The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.00961 Published 2018-08-03 No fix listed CWE-209

TI-2018-10721 CVE-2018-14906 · GHSA-cvcp-69pf-j53g

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters.

LOW 28

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00692 Published 2018-08-03 No fix listed CWE-79

TI-2018-10720 CVE-2018-14905 · GHSA-8xg6-v236-cg26

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.

LOW 28

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00692 Published 2018-08-03 No fix listed CWE-79

Vulnerabilities

Filters

The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because…

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters.

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.