CVE-2019-15059 Information disclosure in n/a
Unauthenticated attackers can download configuration backups containing sensitive PBX data like passwords and contacts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15059?
CVE-2019-15059 is a high-severity vulnerability in n/a, published on 12 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords.
Weakness: CWE-863
Which versions are affected by CVE-2019-15059?
It affects 1 product.
Products include Lispbx Project Lispbx.
How do I fix CVE-2019-15059?
No fix has been published for CVE-2019-15059 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15059 being exploited?
There is no known exploitation of CVE-2019-15059 in the wild and no public exploit code.
Sources
Also known as GHSA-x559-xx5v-vc9g.