CVE-2017-15359: Path Traversal
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to access sensitive information to aid in subsequent attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15359?
CVE-2017-15359 is considered a high severity vulnerability due to its potential to allow directory traversal attacks on the 3CX Phone System.
How do I fix CVE-2017-15359?
To fix CVE-2017-15359, update the 3CX Phone System to a version later than 15.5.3554.1 that contains security patches.
What software is affected by CVE-2017-15359?
CVE-2017-15359 affects the 3CX Phone System version 15.5.3554.1.
Can an untrusted user exploit CVE-2017-15359 without authentication?
No, an attacker must be authenticated to exploit CVE-2017-15359.
What parameters are involved in CVE-2017-15359 vulnerability exploitation?
The vulnerable parameters in CVE-2017-15359 are '/api/RecordingList/DownloadRecord?file=' and '/api/SupportInfo?file='.