CVE-2019-12148 - The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field

Back Back to CVE browser

CRITICAL

The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field

Published Oct 22, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 3.53%

Description

The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field. Upon successful exploitation, a remote unauthenticated user can login into the device's admin web portal without providing any credentials. This affects /var/webconfig/gui/Webconfig.inc.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-88

References (2)

http://packetstormsecurity.com/files/154915/Sangoma-SBC-2.3.23-119-GA-Authentication-Bypass.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Oct/41
mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/154915/Sangoma-SBC-2.3.23-119-GA-Authentication-Bypass.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Oct/41		mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 22, 2019

Updated Aug 4, 2024

Reserved May 16, 2019

Link CVE-2019-12148

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-12148

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-12148