Directory Traversal Vulnerability in FusionPBX by FusionPBX
CVE-2020-21055

6.5MEDIUM

Key Information:

Vendor

Fusionpbx

Status
Fusionpbx
Vendor
CVE Published:
20 May 2021

What is CVE-2020-21055?

A Directory Traversal vulnerability in FusionPBX version 4.5.7 allows unauthorized users to manipulate file system operations. By exploiting this vulnerability through the 'folder', 'filename', and 'newfilename' parameters in the 'app/edit/filerename.php' script, attackers can rename any file within the system, potentially leading to unauthorized access and manipulation of sensitive information.

References

https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-pa...
x_refsource_MISC
https://github.com/fusionpbx/fusionpbx/commit/1a88ca61a74...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.