CVE-2019-14935: High severity 3cx call flow designer vulnerability
3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and leading to privilege escalation because of a StartUp link.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-14935.
What is the severity of CVE-2019-14935?
The severity of CVE-2019-14935 is high with a severity value of 7.8.
How does CVE-2019-14935 affect 3CX Phone 15 on Windows?
CVE-2019-14935 affects 3CX Phone 15 on Windows by having insecure permissions on the %PROGRAMDATA%\3CXPhone for Windows\PhoneApp installation directory, allowing Full Control access for Everyone, which can lead to privilege escalation.
How can the insecure permissions on the installation directory be fixed?
To fix the insecure permissions on the installation directory, the access control list (ACL) for the directory should be modified to restrict access to authorized users only.
Is there any additional information available about CVE-2019-14935?
Yes, more information about CVE-2019-14935 can be found at the following reference: [link](https://www.3cx.com/community/threads/security-issue-with-3cx-windows-client-install.64432/)