Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: GOautodial Component: Goautodial Api Clear all filters
TI-2021-19190 CVE-2021-43176 · GHSA-fg34-7vm6-7mc4

Path traversal in GOautodial API

Priority MEDIUM 41

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01356 Published 2021-12-07 Fixed in 3c3a979 CWE-23
TI-2021-19189 CVE-2021-43175 · GHSA-jgjr-5rhg-5c7w

Authentication bypass in GOautodial API

Priority LOW 35

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01199 Published 2021-12-07 Fixed in 3c3a979 CWE-305