A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Coalescent Systems
  • Freepbx
Sangoma
  • Freepbx

Configuration 1 [-]

cpe:2.3:a:sangoma:freepbx:17.0.19.17:*:*:*:*:*:*:*

No data.

References
Link Providers
https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903 cve-icon cve-icon
https://gist.github.com/hyp164D1/d419bdf3e7e352088a21631d0f452a8c cve-icon cve-icon
History

Tue, 23 Sep 2025 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Sangoma
Sangoma freepbx
CPEs cpe:2.3:a:sangoma:freepbx:17.0.19.17:*:*:*:*:*:*:*
Vendors & Products Sangoma
Sangoma freepbx

Tue, 14 Jan 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jan 2025 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94

Thu, 09 Jan 2025 00:45:00 +0000

Type Values Removed Values Added
Description A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences. A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.

Thu, 09 Jan 2025 00:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do. A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences.

Wed, 08 Jan 2025 19:00:00 +0000

Type Values Removed Values Added
Description A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences. A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.

Wed, 08 Jan 2025 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-434
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 2.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N'}

Tue, 03 Dec 2024 21:00:00 +0000

Type Values Removed Values Added
Description An authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of freepbx v17.0.19.17 allows attackers to execute arbitrary code via uploading a crafted file. A serious vulnerability was discovered in FreePBX 17.0.19.17. FreePBX does not verify the type of uploaded files and does not restrict user access paths, allowing attackers to remotely control the FreePBX server by uploading malicious files with malicious content and accessing the default directory where the files are uploaded. This will result in particularly serious consequences.

Tue, 03 Dec 2024 18:45:00 +0000

Type Values Removed Values Added
References

Tue, 03 Dec 2024 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Coalescent Systems
Coalescent Systems freepbx
Weaknesses CWE-94
CPEs cpe:2.3:a:coalescent_systems:freepbx:*:*:*:*:*:*:*:*
Vendors & Products Coalescent Systems
Coalescent Systems freepbx
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 02 Dec 2024 17:45:00 +0000

Type Values Removed Values Added
Description An authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of freepbx v17.0.19.17 allows attackers to execute arbitrary code via uploading a crafted file.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-12-02T00:00:00

Updated: 2025-01-14T16:41:16.578Z

Reserved: 2024-11-20T00:00:00

Link: CVE-2024-53564

cve-icon Vulnrichment

Updated: 2024-12-03T15:06:38.663Z

cve-icon NVD

Status : Analyzed

Published: 2024-12-02T18:15:11.353

Modified: 2025-09-23T13:00:30.710

Link: CVE-2024-53564

cve-icon Redhat

No data.