Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-51996 | A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do. |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 23 Sep 2025 22:15:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Sangoma
Sangoma freepbx |
|
| CPEs | cpe:2.3:a:sangoma:freepbx:17.0.19.17:*:*:*:*:*:*:* | |
| Vendors & Products |
Sangoma
Sangoma freepbx |
Wed, 15 Jan 2025 02:15:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
ssvc
|
Fri, 10 Jan 2025 02:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-94 |
Thu, 09 Jan 2025 09:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences. | A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do. |
Thu, 09 Jan 2025 09:15:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do. | A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences. |
Thu, 09 Jan 2025 04:00:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences. | A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do. |
Thu, 09 Jan 2025 03:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-434 | |
| Metrics |
cvssV3_1
|
cvssV3_1
|
Wed, 04 Dec 2024 06:00:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of freepbx v17.0.19.17 allows attackers to execute arbitrary code via uploading a crafted file. | A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences. |
Wed, 04 Dec 2024 03:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 04 Dec 2024 00:15:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Coalescent Systems
Coalescent Systems freepbx |
|
| Weaknesses | CWE-94 | |
| CPEs | cpe:2.3:a:coalescent_systems:freepbx:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Coalescent Systems
Coalescent Systems freepbx |
|
| Metrics |
cvssV3_1
|
Tue, 03 Dec 2024 02:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of freepbx v17.0.19.17 allows attackers to execute arbitrary code via uploading a crafted file. | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-01-14T16:41:16.578Z
Reserved: 2024-11-20T00:00:00
Link: CVE-2024-53564
Vulnrichment
Updated: 2024-12-03T15:06:38.663Z
NVD
Status : Analyzed
Published: 2024-12-02T18:15:11.353
Modified: 2025-09-23T13:00:30.710
Link: CVE-2024-53564
Redhat
No data.
OpenCVE Enrichment
No data.