High severity · published Apr 26, 2023
CVE-2023-26567
Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Freepbx Linux 7 · Sangoma
1805; 1904; 1910; 2002; 2008; 2011; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26567
Third Party Advisory
https://qsecure.com.cy/resources/advisories/sangoma-freepbx-linux-insecure-permissions
Product
https://www.freepbx.org
Product
https://www.sangoma.com/products/open-source/