« Volver al listado

CVE-2020-10666

Estado: ModificadaCrítica (9.8)—

The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sangoma — Restapps

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-10666",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-31T12:15:08.717",
  "references": [
    {
      "url": "https://wiki.freepbx.org/display/FOP/2020-03-12+SECURITY%3A+Potential+Rest+Phone+Apps+RCE",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.freepbx.org/display/FOP/2020-03-12+SECURITY%3A+Potential+Rest+Phone+Apps+RCE",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command."
    },
    {
      "lang": "es",
      "value": "El módulo restapps (también se conoce como aplicaciones Rest Phone) para Sangoma FreePBX y PBXact versiones 13, 14 y 15 hasta 15.0.19.2, permite una ejecución de código remota por medio de una variable URL en un comando AMI"
    }
  ],
  "lastModified": "2026-06-17T02:48:12.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sangoma:restapps:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4EE6D96-B897-490A-AD2D-85FA89A6399F",
              "versionEndIncluding": "13.0.93.2",
              "versionStartIncluding": "13.0"
            },
            {
              "criteria": "cpe:2.3:a:sangoma:restapps:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCEBAA67-50C0-4A91-8707-2FB3B1981B9D",
              "versionEndIncluding": "14.0.22.2",
              "versionStartIncluding": "14.0"
            },
            {
              "criteria": "cpe:2.3:a:sangoma:restapps:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "725A46EC-3F07-4811-9E90-8CD61316A980",
              "versionEndIncluding": "15.0.19.2",
              "versionStartIncluding": "15.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sangoma:freepbx:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "56F9D7C9-4F22-4BB6-9F17-CE0DFC2CD659"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}