Login Request a demo
Unscored severity · published Feb 18, 2014
CVE-2014-1903
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions…
–
CVSS
51.8%
EPSS
No
On KEV
Description
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)51.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Freepbx · Freepbx
2.10; 2.11; 2.12 · source: NVD
Affected product
FR
Freepbx
Freepbx
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1903
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1903
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0097.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0111.html
code.freepbx.org
http://code.freepbx.org/changelog/FreePBX_Framework?cs=a29382efeb293ef4f42aa9b841dfc8eabb2d1e03
code.freepbx.org
http://code.freepbx.org/changelog/FreePBX_SVN?cs=16429
Vendor Advisory
http://issues.freepbx.org/browse/FREEPBX-7117
Vendor Advisory
http://issues.freepbx.org/browse/FREEPBX-7123
More from Freepbx
8.8
CVE-2024-58294
FreePBX 16 Authenticated Remote Code Execution via API Module
4.8
CVE-2018-15891
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4
–
CVE-2014-7235
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to…
–
CVE-2009-4458
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via…
–
CVE-2009-1803
FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists,…