All errata/sisyphus/ALT-PU-2019-1011-1
ALT-PU-2019-1011-1

Package update freeswitch in branch sisyphus

Version1.8.4-alt1
Published2019-01-08
Max severityHIGH
Severity:

Closed issues (1)

CVE-2018-19911
HIGH7.5

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.

Published: 2018-12-06Modified: 2024-11-21
CVSS 2.0HIGH 7.6
CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H