Vulnerability Description
3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 3Cx | 3Cx | < 18.0.2.315 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-inter
- https://www.3cx.com/blog/change-log/phone-system-change-log/Release Notes
- https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-inter
- https://www.3cx.com/blog/change-log/phone-system-change-log/Release Notes
FAQ
What is CVE-2022-48482?
CVE-2022-48482 is a vulnerability with a CVSS score of 7.5 (HIGH). 3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials,...
How severe is CVE-2022-48482?
CVE-2022-48482 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-48482?
Check the references section above for vendor advisories and patch information. Affected products include: 3Cx 3Cx, Microsoft Windows.