CVE-2018-19911: CSRF
FreeSWITCH through 1.8.2, when modxmlrpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bgsystem or txtapi/bgsystem) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-19911?
CVE-2018-19911 is a vulnerability in FreeSWITCH through version 1.8.2 that allows remote attackers to execute arbitrary commands.
What is the severity level of CVE-2018-19911?
The severity level of CVE-2018-19911 is high, with a severity score of 7.5.
How does CVE-2018-19911 affect FreeSWITCH?
CVE-2018-19911 affects FreeSWITCH through version 1.8.2 when the mod_xml_rpc module is enabled.
How can CVE-2018-19911 be exploited?
CVE-2018-19911 can be exploited by sending a malicious query string to the api/system or txtapi/system endpoints on TCP port 8080, allowing remote code execution.
Are there any known fixes or patches for CVE-2018-19911?
At the time of writing, there are no known fixes or patches available for CVE-2018-19911. It is recommended to follow the vendor's security advisories for updates.