CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Other sources
Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-19006?
CVE-2019-19006 is a vulnerability in Sangoma FreePBX versions 14.0.13.11 and below, 13.0.197.13 and below, and 15.0.16.26 and below that allows incorrect access control.
How severe is CVE-2019-19006?
CVE-2019-19006 has a severity rating of 9.8 out of 10, which is considered critical.
Which versions of Sangoma FreePBX are affected by CVE-2019-19006?
Versions 14.0.13.11 and below, 13.0.197.13 and below, and 15.0.16.26 and below of Sangoma FreePBX are affected by CVE-2019-19006.
What is the Common Weakness Enumeration (CWE) ID for CVE-2019-19006?
The CWE ID for CVE-2019-19006 is CWE-287.
How can I fix CVE-2019-19006?
To fix CVE-2019-19006, it is recommended to update Sangoma FreePBX to a version that is not affected by the vulnerability.