Описание
In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)
Ссылки
- Not Applicable
- Not Applicable
- Third Party Advisory
- Not Applicable
- Not Applicable
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.5.7 (включая)
cpe:2.3:a:fusionpbx:fusionpbx:*:*:*:*:*:*:*:*
EPSS
Процентиль: 65%
0.00485
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 6.5
github
больше 3 лет назад
In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)
EPSS
Процентиль: 65%
0.00485
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-22