File Upload Vulnerability in FreePBX by Sangoma Technologies

CVE-2024-53564

What is CVE-2024-53564?

A file upload vulnerability has been identified in FreePBX version 17.0.19.17, where the system fails to properly verify the type of uploaded files, specifically valid FreePBX modules. This oversight permits high-privilege administrators to potentially insert unauthorized files into the system. Although the supplier asserts that the risk is limited to actions permitted for high-privilege users, this poses a significant security concern that should not be overlooked.

References