Search
Find a vulnerability
Search criteria
2 vulnerabilities found for endpoint_manager by freepbx
CVE-2024-47071 (GCVE-0-2024-47071)
Vulnerability from nvd – Published: 2024-10-01 15:40 – Updated: 2026-02-13 21:52
VLAI
EPSS
VEX
Title
OSS Endpoint Manager allows unauthorized access to read system files
Summary
OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-01 16:09 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreePBX/security-reporting/sec… | x_refsource_CONFIRM |
| https://github.com/FreePBX-ContributedModules/end… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FreePBX | endpointman |
Affected:
< 14.0.4
|
|
| freepbx | endpoint_manager |
Affected:
0 , < 14.0.4
(custom)
cpe:2.3:a:freepbx:endpoint_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:freepbx:endpoint_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "endpoint_manager",
"vendor": "freepbx",
"versions": [
{
"lessThan": "14.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47071",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T16:09:36.724091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T16:15:01.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "endpointman",
"vendor": "FreePBX",
"versions": [
{
"status": "affected",
"version": "\u003c 14.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-13T21:52:08.659Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww"
},
{
"name": "https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719"
}
],
"source": {
"advisory": "GHSA-x9wc-qjrc-j7ww",
"discovery": "UNKNOWN"
},
"title": "OSS Endpoint Manager allows unauthorized access to read system files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-47071",
"datePublished": "2024-10-01T15:40:46.257Z",
"dateReserved": "2024-09-17T17:42:37.029Z",
"dateUpdated": "2026-02-13T21:52:08.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-47071 (GCVE-0-2024-47071)
Vulnerability from cvelistv5 – Published: 2024-10-01 15:40 – Updated: 2026-02-13 21:52
VLAI
EPSS
VEX
Title
OSS Endpoint Manager allows unauthorized access to read system files
Summary
OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-01 16:09 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreePBX/security-reporting/sec… | x_refsource_CONFIRM |
| https://github.com/FreePBX-ContributedModules/end… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FreePBX | endpointman |
Affected:
< 14.0.4
|
|
| freepbx | endpoint_manager |
Affected:
0 , < 14.0.4
(custom)
cpe:2.3:a:freepbx:endpoint_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:freepbx:endpoint_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "endpoint_manager",
"vendor": "freepbx",
"versions": [
{
"lessThan": "14.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47071",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T16:09:36.724091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T16:15:01.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "endpointman",
"vendor": "FreePBX",
"versions": [
{
"status": "affected",
"version": "\u003c 14.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-13T21:52:08.659Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww"
},
{
"name": "https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719"
}
],
"source": {
"advisory": "GHSA-x9wc-qjrc-j7ww",
"discovery": "UNKNOWN"
},
"title": "OSS Endpoint Manager allows unauthorized access to read system files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-47071",
"datePublished": "2024-10-01T15:40:46.257Z",
"dateReserved": "2024-09-17T17:42:37.029Z",
"dateUpdated": "2026-02-13T21:52:08.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}