CVE-2022-28005 Path traversal in n/a
Unauthenticated attackers can exploit path traversal to disclose credentials, then upload malicious files to achieve remote code execution as SYSTEM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-28005?
CVE-2022-28005 is a critical path traversal vulnerability in n/a, published on 6 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server (via /Electron/download directory traversal in conjunction with a path component that uses backslash characters), leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.
Weakness: CWE-522
Which versions are affected by CVE-2022-28005?
It affects 1 product.
Products include 3cx 3cx.
How do I fix CVE-2022-28005?
No fix has been published for CVE-2022-28005 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-28005 being exploited?
There is no known exploitation of CVE-2022-28005 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-m9wh-p6h4-rmvw.