PatchTheCVE3cx vulnerabilities and fixes
Recent CVEs affecting 3cx, with upgrade or downgrade steps. 2 tracked.
3cx has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2024-05-03. Highest priority: CVE-2023-49954 (score 60/100).
- CVE-2023-49954 CRITICAL 9.8 UPGRADE The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, s
- CVE-2023-27362 HIGH 7.8 UPGRADE 3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability
FAQ
How do I fix 3cx vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is 3cx being exploited right now?
None of the tracked 3cx CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which 3cx CVE should I patch first?
CVE-2023-49954 currently ranks highest (60/100): The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, s.