Medium severity · published Oct 1, 2024
CVE-2024-47071
OSS Endpoint Manager allows unauthorized access to read system files
6.8
CVSS
0.5%
EPSS
No
On KEV
Description
OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
endpointman · FreePBX
< 14.0.4 · source: vendor
EM
Endpoint Manager · Freepbx
before 14.0.4 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47071
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47071
github.com
https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719
github.com
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww
More from endpointman
8.6
CVE-2025-61678
FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter