Sign-up

ID

VAR-201812-1006


CVE

CVE-2018-19911


TITLE

FreeSWITCH Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-014321

DESCRIPTION

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used. FreeSWITCH Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. FreeSWITCH is a set of free and open source communication software developed by American software developer Anthony Minesale. The software can be used to create audio, video and short message products and applications. The mod_xml_rpc module is one of the modules that supports triggering the API from the web control. There is a security vulnerability in the mod_xml_rpc module in FreeSWITCH 1.8.2 and earlier versions

Trust: 1.8

sources: NVD: CVE-2018-19911 // JVNDB: JVNDB-2018-014321 // VULHUB: VHN-130618 // VULMON: CVE-2018-19911

AFFECTED PRODUCTS

vendor:freeswitchmodel:freeswitchscope:lteversion:1.8.2

Trust: 1.8

sources: JVNDB: JVNDB-2018-014321 // NVD: CVE-2018-19911

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-19911
value: HIGH

Trust: 1.0

NVD: CVE-2018-19911
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201812-259
value: HIGH

Trust: 0.6

VULHUB: VHN-130618
value: HIGH

Trust: 0.1

VULMON: CVE-2018-19911
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-19911
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-130618
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-19911
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-130618 // VULMON: CVE-2018-19911 // JVNDB: JVNDB-2018-014321 // CNNVD: CNNVD-201812-259 // NVD: CVE-2018-19911

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.1

problemtype:CWE-77

Trust: 1.1

problemtype:CWE-20

Trust: 0.9

sources: VULHUB: VHN-130618 // JVNDB: JVNDB-2018-014321 // NVD: CVE-2018-19911

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201812-259

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-201812-259

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-014321

PATCH
title:Top Pageurl:https://freeswitch.com/
Trust: 0.8
title:CVE-POCurl:https://github.com/0xT11/CVE-POC 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/nomi-sec/PoC-in-GitHub 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-19911 // 
            
            
            
            JVNDB: JVNDB-2018-014321

EXTERNAL IDS
db:NVDid:CVE-2018-19911
Trust: 2.6
db:JVNDBid:JVNDB-2018-014321
Trust: 0.8
db:CNNVDid:CNNVD-201812-259
Trust: 0.7
db:VULHUBid:VHN-130618
Trust: 0.1
db:VULMONid:CVE-2018-19911
Trust: 0.1
sources:
            
            
            VULHUB: VHN-130618 // 
            
            
            
            VULMON: CVE-2018-19911 // 
            
            
            
            JVNDB: JVNDB-2018-014321 // 
            
            
            
            CNNVD: CNNVD-201812-259 // 
            
            
            
            NVD: CVE-2018-19911

REFERENCES
url:https://github.com/isafeblue/freeswitch_rce/blob/master/readme-en.md
Trust: 2.6
url:https://github.com/isafeblue/freeswitch_rce/blob/master/freeswitch_rce.py
Trust: 1.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-19911
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-19911
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/352.html
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/77.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/0xt11/cve-poc
Trust: 0.1
url:https://github.com/nomi-sec/poc-in-github
Trust: 0.1
sources:
            
            
            VULHUB: VHN-130618 // 
            
            
            
            VULMON: CVE-2018-19911 // 
            
            
            
            JVNDB: JVNDB-2018-014321 // 
            
            
            
            CNNVD: CNNVD-201812-259 // 
            
            
            
            NVD: CVE-2018-19911

SOURCES
db:VULHUBid:VHN-130618
db:VULMONid:CVE-2018-19911
db:JVNDBid:JVNDB-2018-014321
db:CNNVDid:CNNVD-201812-259
db:NVDid:CVE-2018-19911

LAST UPDATE DATE
2024-11-23T22:30:10.165000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-130618date:2020-08-24T00:00:00
db:VULMONid:CVE-2018-19911date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2018-014321date:2019-03-18T00:00:00
db:CNNVDid:CNNVD-201812-259date:2020-10-22T00:00:00
db:NVDid:CVE-2018-19911date:2024-11-21T03:58:47.887

SOURCES RELEASE DATE
db:VULHUBid:VHN-130618date:2018-12-06T00:00:00
db:VULMONid:CVE-2018-19911date:2018-12-06T00:00:00
db:JVNDBid:JVNDB-2018-014321date:2019-03-18T00:00:00
db:CNNVDid:CNNVD-201812-259date:2018-12-07T00:00:00
db:NVDid:CVE-2018-19911date:2018-12-06T18:29:00.297