CVE-2021-45461
critical · 9.8FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.
9.8
CVSS
21.7%
EPSS (exploit prob.)
98th
EPSS percentile
2021-12-22
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sangoma | restapps | 15.0.19.87 |
| sangoma | restapps | 15.0.19.88 |
| sangoma | restapps | 16.0.18.40 |
| sangoma | restapps | 16.0.18.41 |
| sangoma | freepbx | all versions |
| sangoma | pbxact | all versions |
Check a specific version with /api/v1/cve/match.
References
- https://community.freepbx.org/t/0-day-freepbx-exploit/80092
- https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109
- https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE
- https://community.freepbx.org/t/0-day-freepbx-exploit/80092
- https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109
- https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-45461