Vulnerability · Published May 1, 2020 · Assigned by rapid7
CVE-2020-7351Fonality Trixbox CE Post-Authentication Command Injection
High 7.3
In plain English
A high-severity OS command injection in Trixbox Community Edition from Fonality. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 65.2% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fonality | Trixbox Community Edition | 2.8.0.4 – through 2.8.0.4 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N