CVE-2019-13176 - An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2

Back Back to CVE browser

HIGH

An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2

Published Aug 8, 2019

7.5

HIGH

CVSS 3.0

EPSS 2.46%

Description

An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF (reading local files, outbound HTTP, and outbound DNS).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4701
Advisory
https://www.logicallysecure.com/blog/3cx-phone-system-web-console-affected-by-xxe/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4701		Advisory
https://www.logicallysecure.com/blog/3cx-phone-system-web-console-affected-by-xxe/		x_refsource_MISCExploitThird Party Advisory