CVE-2018-7654 | BDVDB-2026-97361 Detail

Description#

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://medium.com/stolabs/path-traversal-in-3cx-7421a8ffdb7a
http://www.rootlabs.com.br/path-traversal-in-3cx/

Exploit#

No public exploit known

History#

Version 12018-03-04Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.