CVE-2023-43336

published 2023-11-02

CVE-2023-43336: Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter…

Priority P3 48 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sangoma	freepbx	< 15.0.16	15.0.16
sangoma	freepbx	< 15.0.18	15.0.18
sangoma	freepbx	>= 16.0.2 < 16.0.17	16.0.17
sangoma	freepbx	>= 16.0.2 < 16.0.40	16.0.40

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284